Robinhood data breach 2021: what happened and what to do

Robinhood is a trading app with millions of retail investors. On the evening of 3 November 2021, an attacker reached its customer support systems, and the company disclosed it on 8 November. Have I Been Pwned (HIBP) added 5,003,937 email addresses on 3 March 2022.

What happened

Robinhood said an unauthorised third party socially engineered a customer support employee by phone. Social engineering means tricking a person, instead of breaking software. With that access, the attacker reached certain customer support systems. The attacker then demanded an extortion payment, which Robinhood reported to law enforcement. It brought in the security firm Mandiant to investigate.

Robinhood's own breakdown, as reported by Fortune and Security Affairs, was that the attacker obtained a list of email addresses for about 5 million customers and full names for a separate group of about 2 million. That gives the "about 7 million" in headlines. A much smaller group was hit harder: about 310 people had names, dates of birth and zip codes taken, and around 10 had more extensive account details revealed.

What was exposed

HIBP lists one data type: email addresses, 5,003,937 of them. Robinhood said Social Security numbers, bank account numbers and debit card numbers were not exposed, and that no customer lost money.

What that lets criminals do

An email address alone does not open an account, but it tells a scammer that you probably hold a brokerage account. That is useful. Expect phishing that pretends to be Robinhood: a "suspicious login" alert, a "verify your identity" request or a fake account restriction, each with a link to a copy of the login page. A real login on a fake page gives away your password and your two-factor code in one move.

Trading accounts are a target because money can leave quickly. A stolen login could be used to sell holdings and move cash out, so a phishing click costs more here than on a shopping site.

For the 310 people whose birth dates and zip codes were taken, the risk reaches identity theft. For everyone else it is mainly phishing.

The company's response

Robinhood disclosed the incident within days, told affected customers by email, reported the extortion attempt and hired Mandiant. It said it had no evidence of financial loss.

Where this leaves you

The exposed list is old, but email addresses on it keep working as targets for years. Treat any unexpected message about your Robinhood account as fake until you check the app yourself. If you hold other investment or banking apps, the same rule applies to them: the attack worked by persuading a person on the phone, so a caller who sounds helpful and knows your email address is still just a caller. Hang up, open the app and use the support option inside it.