HC3 Warns Of Mailchimp’s
Data Breach To Healthcare Providers

Mailchimp, an email marketing platform company, revealed a compromise affecting one of its internal technologies used by its customer service and account management staff on April 4, 2022.

Although Mailchimp disabled the compromised employee accounts upon the breach’s discovery, threat actors were still able to see about 300 Mailchimp user accounts and gain audience data from 102 of them, according to the company’s CISO.

Additionally, threat actors gained access to an unspecified number of customers’ API keys, which enabled attackers to develop custom email campaigns, such as phishing campaigns, and send them to mailing lists without logging into the MailChimp client interface.

While HC3 is currently aware of only one phishing campaign that exploited this unauthorized access to send phony data breach notification emails to users in the cryptocurrency and finance sectors (which was reportedly carried out with exceptional sophistication and planning), the Healthcare and Public Health (HPH) sector should remain vigilant for suspicious emails originating from legitimate email marketing platforms such as Mailchimp.

It’s critical to remember that APT groups have previously used legitimate mass mailing providers to launch malicious email campaigns against a diverse range of businesses and industry verticals.