Robinhood, a stock-trading platform, has recently disclosed a data breach currently affected 7 million customers following a compromise on November 3rd, 2021. Robinhood, in their posting linked below, stated that an unauthorized third-party gained access to “a limited amount of personal information for a portion of customers”. The threat actor “socially engineered a customer service employee by phone and obtained access to certain customer support systems”. The platform also revealed that approximately 5 million individuals had their email addresses exposed, roughly 2 million individuals had their full names exposed, and a small subset of people (approximately 310 total) had their name, date of birth, and zip code accessed. Ten (10) customers also had more extensive account data exposed as well, but the extent has yet to be released. Robinhood emphasized that it believes “no Social Security numbers, back account numbers, or debit card numbers were exposed” as well as “no financial loss to any customers” is involved. This breach is still being investigated as the actor responsible has demanded an extortion payment from Robinhood, and CTAPT will provide updates as additional details are released.