Gemini, a well-known cryptocurrency exchange, recently revealed a data breach incident that occurred due to a cyberattack on its Automated Clearing House (ACH) service provider. This breach impacted individuals and the exchange began notifying affected parties on June 26, 2024. The incident was recently brought to the attention of the Attorney General’s Office in California through a submission of sample notification letters.
The data breach at Gemini took place between June 3 and June 7, 2024, when an unauthorized actor gained access to the systems of Gemini’s vendor, responsible for facilitating fund transfers from Gemini wallets to customers’ bank accounts and processing certain customer data in the process. The official notice stated that the breach was a result of a security incident involving one of the banking partner’s service providers.
Gemini’s banking partner reported that a subset of customer banking information may have been compromised during the breach. The unauthorized access to an internal collaboration tool on the banking partner’s system potentially exposed transactional data, including customers’ names, bank account numbers, and routing numbers. However, sensitive information such as dates of birth, addresses, social security numbers, email addresses, phone numbers, usernames, and passwords remained secure and unaffected.
Upon discovering the breach, Gemini’s banking partner initiated an investigation and implemented measures to contain the incident. External forensic experts were engaged to conduct a thorough investigation, with the involvement of law enforcement authorities.
Gemini advised affected customers to contact their banks to inquire about steps to protect their accounts, enable multi-factor authentication on provided bank accounts, closely monitor account statements, and stay vigilant against potential scams exploiting financial data knowledge. Customers were also encouraged to review account statements regularly, obtain and monitor their credit reports, and consider placing a security freeze on their credit files to prevent new credit from being opened without proper authorization.
Gemini’s proactive response to the data breach highlights the company’s commitment to security and customer care. Despite the breach originating from a third-party service provider, Gemini is actively working to mitigate potential damage and safeguard customer data.
In conclusion, the incident serves as a reminder of the importance of robust cybersecurity measures in the rapidly evolving cryptocurrency landscape. It underscores the necessity for companies like Gemini to have stringent security protocols in place to protect sensitive customer information and maintain trust in the digital asset ecosystem.