OpenSea has notified customers of a data breach after staff discovered email addresses were shared with an external party.
In a shocking blog post on Wednesday, Head of Security Cory Hardman revealed that one employee at Customer.io, OpenSea's email delivery vendor abused their access by downloading and externally sharing customer data without permission.
"If you have shared your email with us in the past, you should assume you were impacted," he wrote. "We are working with Customer.io in their ongoing investigation, and we have reported this incident to law enforcement."
The company has notified customers that they might face phishing attacks by cybercriminals who use domains similar to the official "opensea.io," such as "opensea.org" or "opensae.io."
Screenshots posted to Twitter showed that users were notified about the data breach via email by OpenSea, with some demanding compensation.
OpenSea data breach. pic.twitter.com/FEtDKsoHje
— eric.eth (@econoar) June 30, 2022
Customer.io did not respond to press inquiries after several attempts by the press.
In March of this year, hackers pierced through a third-party marketing vendor HubSpot and targeted large crypto stakeholders. NYDIG, Pantera Capital, BlockFi, Circle, and Swan Bitcoin were among those affected by these attacks
The OpenSea team has been in the news a lot lately, and it's not all good. The company found itself fighting an uphill battle due to another incident prior to this data breach. The Department of Justice charged its former head of products, Nathaniel Chastain with insider trading concerning non-fungible tokens (NFTs). He was charged with one count of wire fraud and another, more severe money laundering charge.
Chastain's resignation from the firm was announced in September after he was suspected of profiting on inside information and purchasing NFTs before they were publicly available.
OpenSea continues to dominate the NFT marketplace by a wide margin, with over six times as many sales compared to the second-largest competitor, according to data from DappRadar.