The Robinhood hack is worse than originally thought. On Tuesday, the stock trading app reported the attackers also stole phone numbers from several thousands users.
Robinhood confirmed the news after Motherboard obtained a file of about 4,400 stolen phone numbers from a representative for the hackers who pulled off the breach. Robinhood didn’t confirm the exact number of users affected, but says it’s still examining the data the attackers stole, which took the form of a list.
“We’ve determined that several thousand entries in the list contain phone numbers, and the list also contains other text entries that we’re continuing to analyze,” the company says.
Losing the phone numbers risks exposing affected Robinhood users to a SIM-swapping attack. This occurs when a hacker tries to trick a cellular provider into handing over access to your mobile phone number. If the cellular provider falls for the scheme, then it’ll transfer your phone number to a new SIM card, which the hackers can then plug into their device.
Getting SIM-swapped can be particularly devastating because mobile phone numbers are often used to receive one-time passcodes to log in or reset the password for an online account. Robinhood itself offers two-factor authentication via SMS messages.
In response, Robinhood says it’s notifying affected users who had their phone numbers exposed in the hack. To protect themselves, they’ll also want to avoid using SMS-based two-factor authentication systems and instead use an authenticator app on the phone to supply the one-time passcodes.
According to Robinhood, the attackers used social engineering tricks to dupe a customer support employee into letting them access internal systems. The company says email address data belonging to 5 million users was mainly exposed in the hack. However, Motherboard is reporting the culprits also briefly had access to an internal tool capable of tampering with user accounts, although Robinhood says it detected no changes were made to any accounts.
On Tuesday, Robinhood added: “We continue to believe that the list did not contain Social Security numbers, bank account numbers, or debit card numbers and that there has been no financial loss to any customers as a result of the incident.”
