- The employee belonged to one of Celcius’ business data management and messaging vendors
- The news cited that one of their employees accessed a list of Celsius client email addresses
- Celsius announced that it initiated voluntary Chapter II proceedings
On July 26, Celsius sent an email to its customers revealing that some of the customer data were leaked in a third-party data breach.
Surprisingly, this attack acts as one of many other attacks on the company’s official website in the last few months.
Breach of the Celsius Emails
Celsius reveals one of its employees from the company’s business data management and messaging vendors initiated the breach of the customer’s emails.
Upon follow-up, the company noted the breach came from an engineer at the Customer.io messaging platform. Celsius cited that they received the news from their vendor Customer.io.
The data breach follows a similar attack that leaked OpenSea customer email addresses in June. However, Celsius played down claiming the attack did not present a high risk to clients.
The company insisted that they only intended to create awareness among their customers.
How it happened
On July 7, Customer.io cited that the recent attacks came about because of deliberate actions by a senior engineer. The engineer, as claimed by Celsius, possessed an appropriate level of access to perform their duties.
Hence, the high-level access provided a means of relaying email addresses to a third party. Celsius terminated the employee’s contract following the breach. The company, meanwhile, does not reveal the number of emails that got leaked.
The platform to which they leaked remains a mystery as well. Nevertheless, the crypto community started to warn Celsius users of Phishing attacks.
Celsius took an initiative and alerted its users of phishing emails along the lines of “Verify your wallet to withdraw your funds.” The phishing emails aim for the clients’ SRP/PKey.
Celsius survival strategy
A similar data breach occurred in April 2021. The attack involved a fraudulent website targetting Celsius customers. The attacker disguised as an official of the Celsius website sent SMS and emails to some clients prompting them to reveal personal information and seed phrases.
Consequently, the company reported that hackers managed to gain access to a third-party email distribution system that it uses.
Celsius announced that it initiated voluntary Chapter II proceedings. The move seeks to provide the company with the opportunity to stabilize its business. The strategy aims to consummate a comprehensive restructuring process that maximizes value for all stakeholders.
To implement the restructuring, the company and certain of its subsidiaries filed voluntary petitions. The petitions target its reorganization under Chapter II of the US Bankruptcy code.
The filings follow the difficult but necessary decision by Celsius last month to pause withdrawals, swaps and transfers. The objective of the decision seemed to stabilize its business and protect its customers.
Celsius claimed to possess $167 million in cash on hand. The cash will provide ample liquidity to support operations during the restructuring process.
