how it happened
- whoattackerssocial engineering
- the gapinternal support toolpower over customer accounts
- the result133 accounts accessedsecond time in 6 months
what everyone assumed
Internal tooling feels protected by being internal: it is behind the perimeter, used by trusted staff, not exposed to the world. The assumption is that a tool customers never see is a tool attackers cannot reach.
what happened
Attackers socially engineered employees and contractors to hand over credentials, then used the internal support tool exactly as intended, to reach customer accounts. The tool’s power over customer data was the point of the attack, and it had been built for convenience, not for resisting a logged-in impostor.
step by step
- staff and contractors are socially engineeredThey hand over credentials.
- the internal support tool is used as designedBuilt for convenience, not to resist a logged-in impostor.the assumption breaks here
- January 2023133 customer accounts accessedThe second near-identical incident in under six months.
how it surfaced
In January 2023 Mailchimp disclosed that 133 customer accounts had been accessed through its internal support tooling after staff were socially engineered. It was the company’s second nearly identical incident in under six months.
Internal tooling is only as safe as the credentials that open it, and powerful support tools are a prize precisely because of what they can reach.
Behind the perimeter is not the same as out of reach.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersAn attacker tricks a support worker into handing over their login.what it costs youThey browse customer accounts using the tool built to help them.
- or it goes like thisit happenedMGM Resorts, 2023howA caller poses as an admin and gets a password and code reset in minutes.what leavesadmin control of identity and cloudwho ends up with itattackers who deploy ransomware
- or it goes like thisit happenedClorox and Cognizant, 2023howAn outsourced desk resets an account three times without checking the caller.what leavesa fully working employee loginwho ends up with itan intruder who looks legitimate everywhere
sources
your turn
what you can do about it
this week
List who can reach customer data through internal tools, and how those logins are protected.
Your support, admin, and account-management tools can touch customer data by design, and they are protected mainly by the logins of the people who use them. Mailchimp is what happens when those logins are phished. Who can reach customer data through internal tools, and how strongly those accounts are protected, is the exposure.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →