The cryptocurrency sector is grappling with a new vulnerability in its digital supply chain. French platform Paymium recently informed its users that a security breach at its email service provider, Brevo, has led to the exposure of sensitive personal data. While financial assets, passwords, and API keys remain secure and out of the attackers' reach, information such as full identities, dates of birth, and phone numbers has been compromised. This incident occurs in a climate of heightened vulnerability, following a series of similar cyberattacks that have targeted other industry players like Trezor.
The root of the breach lies in a critical vulnerability within the single sign-on protocol, or SSO (Single Sign-On), of the Brevo platform. By exploiting this flaw in compartmentalization, attackers successfully infiltrated 138 corporate client accounts. This mechanism allowed the hackers to extract contact lists and use certain interfaces to distribute massive phishing campaigns. While Paymium confirmed the breach on September 22, the incident underscores the difficulty Web3 companies face in ensuring the confidentiality of data processed by their third-party technology partners.
The primary concern regarding this leak lies in the malicious exploitation of the stolen information. The combination of a name, date of birth, and phone number provides a prime database for scammers looking to orchestrate sophisticated phishing attempts or fraudulent calls posing as the platform's security department. Amid a surge in cybercrime targeting digital asset holders, this identifiable data creates a dangerous profiling risk for victims, especially since, unlike passwords, this personal information is immutable.
Faced with this threat, vigilance is essential for the affected users. Experts recommend adopting strict protective habits, such as standardizing two-factor authentication and maintaining absolute suspicion toward any incoming requests, whether via SMS or phone. It is imperative to never disclose recovery phrases and to interact exclusively through the platform's official channels. Although no direct link has been established between data leaks and physical assaults related to cryptocurrencies, caution remains the best defense for investors in an ecosystem where anonymity and data security are becoming constant challenges.