Dear CoinGecko User,
We are writing to inform you about a recent security incident that has affected your CoinGecko user account and personal information. Your privacy and security are of utmost importance to us, and we want to provide you with a transparent account of what happened, the steps we have taken, and what you can do to protect yourself.
Details of the Data Breach
On June 5, 2024, around 06:30 AM UTC, we detected unusual activity on our third-party email marketing platform, GetResponse. An attacker had compromised a GetResponse employee’s account, leading to a breach. We received confirmation from the GetResponse team on 6 June, 2024, at 11:58 AM UTC, that a data breach had occurred.
While no phishing emails were sent from CoinGecko’s domain, the attacker exported 1,916,596 contacts from CoinGecko’s GetResponse account and sent phishing emails to 23,723 emails from another GetResponse client’s account (alj.associates). This activity was flagged by one of our employees, and we worked with GetResponse to promptly block further email delivery.
What Data was Compromised?
We have determined that your personal information was unfortunately compromised in this incident. This information may include:
- Name (if provided during sign-up)
- Email address
- IP address and location of email opens
- Other metadata such as account sign-up date, subscription plan
Your CoinGecko user account remains secure, and no passwords were compromised.
Our Response & Next Steps
We are actively investigating this situation with GetResponse and informing all affected users. Additionally, we are thoroughly reviewing our security procedures and will look to enhance our security protocols in collaboration with our vendors.
What You Can Do To Protect Yourself
Please stay vigilant and exercise caution when opening any emails, as there could be an increase in phishing or spam emails. CoinGecko is not the only crypto company impacted in this organized, targeted attack. To protect yourself:
- Be cautious of emails from unfamiliar or misleading domains.
- Avoid clicking on links or downloading attachments from unsolicited sources.
- Be wary of emails that claim to offer token airdrops.
Any email claiming to offer token airdrops by CoinGecko or GeckoTerminal are unauthorized emails sent by the attacker. We do NOT have any officially issued coins or tokens.