Update: The exfiltrated data from the recent Robinhood data breach has begun being sold on a popular hacking forum/marketplace late last week. Robinhood, a stock-trading platform, disclosed a data breach early last week that affected over 7 million customers following a compromise in their customer support systems on November 3rd, 2021. The overarching compromised data includes email addresses, full names, dates of birth, zip codes, and more extensive account data. Impacted individuals did not have the same exposure, and the specific numbers of individuals per data type can be viewed in November 12th’s reporting. A threat actor dubbed “pompompurin” claimed responsibility for Robinhood’s compromise and began selling the Robinhood data two (2) days after the data breach disclosure. pompompurin claimed that “the 310 Users is not for sale at this current point in time. All other data is.” The 310 users involved the more extensive exfiltrated data and the price for the available data is “5 figures”. The threat actor discussed with BleepingComputer that they gained initial access by “tricking a help desk employee into installing remote access software on their computer” and provided screenshots of internal systems. When BleepingComputer contacted Robinhood, the platform detailed that malware was not utilized in the early November attack and did not confirm directly that the provided screenshots were of its systems (but did ask for all private information to be redacted). CTAPT analysts will continue to monitor threat actors on popular hacking forums and marketplaces.