Crypto firm Nansen asks users to reset passwords after vendor breach

Ethereum blockchain analytics firm Nansen asks a subset of its users to reset passwords following a recent data breach at its authentication provider.

Nansen is a popular entity in the cryptocurrency space, offering users insights into Ethereum wallet activity, helping identify emerging projects, and generally helping people make informed investment decisions.

In a letter sent to impacted users, Nansen says they learned on September 20t that one of their third-party vendors suffered a data breach.

The unnamed vendor was compromised by an attacker who somehow gained access to an admin panel controlling Nansen customer access on the analytics platform.

Nansen stopped the malicious activity shortly after the vendor informed them about the incident, but the ensuing investigation confirmed that user data was compromised.

"Based on our preliminary investigations over the past 48 hours, 6.8% of our users were impacted," reads Nansen's notice shared on Twitter.

"These users had their email addresses exposed, a smaller portion also had password hashes exposed, and a last, smallest group also had their blockchain address exposed."

If you have any information on the breached provider other attacks, you can contact BleepignComputer confidentially via Signal at 646-961-3731 or on Telegram at @lableep.

All impacted users have been informed about the breach via email notifications, while Nansen's support has also contacted them to request a password resetting action.

Nansen says the passwords were encrypted but advises impacted individuals to change passwords, as brute-forcing is always a plausible scenario.

The firm emphasizes the heightened phishing risk for individuals whose details are exposed. Threat actors, now armed with knowledge of digital asset ownership and their email addresses, can target them more effectively.

As the investigation hasn't been completed yet, it is not unlikely that the scope of the impact will be revised to include more users.

Hence, it would be advisable for all Nansen users, regardless of whether they have received a notice, to reset their passwords out of an abundance of caution.