cyber.hendryadrian.com
Cyber Attack & Data Breach · therecord.media

Bitrefill Says Lazarus-Linked Hackers Accessed 18,500 Purchase Records

· Original article ↗

Summary

Bitrefill says hackers it linked to North Korea’s Lazarus Group accessed about 18,500 purchase records after a compromised employee laptop exposed a legacy credential; some crypto wallets were drained. Services were restored March 5.

Key points

  • Bitrefill said its investigation linked the March 1 incident to hackers associated with North Korea’s Lazarus Group, citing tactics, malware, IP addresses, email addresses, and blockchain activity.
  • The company said initial access came through a compromised employee laptop, from which attackers exfiltrated a legacy credential.
  • The credential provided access to a snapshot containing production secrets, enabling escalation into parts of Bitrefill’s infrastructure, including databases and cryptocurrency wallets.
  • About 18,500 purchase records containing email addresses, cryptocurrency payment addresses, and metadata including IP addresses were accessed, according to Bitrefill.
  • Some company cryptocurrency wallets were drained; the amount taken and whether funds were recovered were not disclosed.
  • Bitrefill restored its website and app on March 5 and said it plans to absorb the losses; law enforcement and cybersecurity experts assisted the investigation.

Article Details

Victim Organization
Bitrefill
Incident Type
Cyber intrusion, data breach, and cryptocurrency theft
Data Types Exposed
  • Email addresses
  • Cryptocurrency payment addresses
  • IP address metadata
  • Purchase records
Affected Records
Approximately 18,500 purchase records
Operational Impact
Bitrefill took systems offline after discovering the breach and restored its website and app on March 5. Some company cryptocurrency wallets were drained; the amount taken and whether funds were recovered were not disclosed.
Claim Status
confirmed

MITRE ATT&CK

T1078 · Valid AccountsA stolen legacy credential was used to access a snapshot containing production secrets.

Threat Actors

Lazarus GroupBitrefill attributed the incident to hackers connected to Lazarus Group based on tactics, malware, IP addresses, email addresses, and blockchain activity. The article describes the connection as alleged; the group’s responsibility is not independently confirmed.

Countries

North KoreaIn a lengthy statement, Bitrefill said hackers allegedly tied to North Korea’s Lazarus group accessed around 18,500 purchase records that contained email addresses, crypto payment addresses and metadata including IP

Industries

CryptocurrencyNorth Korean-linked hackers believed to be the Lazarus Group breached cryptocurrency e-commerce platform Bitrefill on March 1, accessing about 18,500 purchase records containing email addresses, crypto payment addresses

Related Articles