HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedTargetedAuthenticationIdentity (basic)PIILowContained

BLOCKFI INC.

bd_a6c9a0c51f2ee84f · schema v1 · pii pii-v1

Severity

Low

Discovered

May 14, 2020

Filed

Jun 25, 2020

To disclose

6 weeks

Affected

696state residents only

Confidence

71%

Full breach record for BLOCKFI INC. →

BlockFi, Inc. reported an unauthorized access incident on May 14, 2020, where an external actor ported an employee's SIM card to access Google accounts and subsequently BlockFi systems via SSO. The actor accessed customer PII (name, email, address, DOB) for approximately 696 Washington residents. No funds or credentials were compromised. BlockFi contained the incident and notified affected individuals.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d6 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 6 weeks / 42 days

May 14, 2020

Begins

May 14, 2020

Discovered

Jun 25, 2020

Filed

vs. sector median

3 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed696 affectedView incident

Name: BLOCKFI INC.
norm: blockfi

Name: BLOCKFI INC.
norm: blockfi
Industry: Financial Servicesllm

Discovered: May 14, 2020
Breach occurred: May 14, 2020
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 14, 2020
Affected individuals: 696state-resident count only
Data types: AuthenticationIdentity (basic)PII
Data elements: NameDate of birthUsername + password
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 0dexposure 0d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Filed data breach notification with Washington Attorney General
Initial access: valid_credentials

During the incident: Disabled the affected employee’s relevant software accounts
Disabled customer trading
Terminated the intruder’s access to BlockFi’s internal system
Promptly notified all customers whose accounts were accessed
Notified all other customers whose information was accessed
Changes made: Implemented security updates to BlockFi's systems
Implemented security updates to employee mobile phones
Enhanced security audits and penetration testing
Disabled potentially affected customer accounts at first indication of compromise
Implemented VictorOps for incident response team
Segregated dedicated critical hardware for personnel with access to customer transactions
Analyzed and limited permissions and privileges among personnel
Removed critical people from critical roles
Analyzed access logs to all services
Encouraged customers to adopt two-step verification
Encouraged customers to whitelist accounts and place 72-hour holding period on withdrawals
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(42 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10563.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 25, 2020
Raw hash: 652bcb21628b27c8886877491e8fae047e30d99f409049cdcb6e818d66c34135

Reporting entityBLOCKFI INC.

Victim entityBLOCKFI INC.

Incidentdiscovered May 14, 2020

Stated responseDisabled the affected employee’s relevant software accounts

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com