Robinhood, a popular trading app, has recently suffered from an online hacking incident that put the personal information of its users in jeopardy. Around 7 million accounts were affected by this attack, and many are concerned about how the incident occurred in the first place. It was reported that around six months ago, some user accounts were compromised on the platform. This may have happened in July 2017, which was when the company first noticed suspicious activity.

Why Was Robinhood Hacked?

Robinhood is only two years old with its headquarters located in New York City. It has become a popular way for individual users to invest fast and easy using their mobile devices. There are no fees when trading stocks or ETFs. This is possible through its mobile application that allows users to monitor the market by showing real-time pricing for any stock they want to track.

For hackers, this is a great opportunity to steal user credentials and personal information, which can lead to future identity theft crimes. It is important that companies like this prioritize their user's safety and security before anything else.

According to Motherboard, a set of stolen phone numbers were obtained from a hacker that presented themselves as a “proxy for the people.'' Robinhood reported that at the beginning of November 2021, one of the employees fell victim to a social engineering attack. The initial attack led to the stealing of 5 million customer emails and 2 million customer names. More than 300 other customers had their zip codes and dates of birth stolen from the databases. There are special cases where more extensive account details were revealed. However, in the original press release by Robinhood, the phone numbers and the amount of people that were directly affected by this hacking incident was not mentioned.

Luckily, sensitive information like bank accounts, debit card numbers, and social security details were not stolen. The company’s cyber security team is currently analyzing other text entries in a list that the hackers obtained. Robinhood posted an update about the incident and confirmed that they will continue to update and make appropriate disclosures to all affected parties.

This was avoidable with the help of internet security services like the ones offered here at Helpy.io. We can protect your internet sites from DDoS attacks, and we also offer protection against malicious traffic to prevent the same thing from happening again.

How the hacking happened?

Robinhood is a free stock trading portfolio app that has more than 10 million users. It allows people to trade with real-life stocks without the hassle of fees attached to other brokerage firms, such as Merrill Lynch. According to the company, users need only a mobile phone and the app.

The previous cyberattack was executed because of old-fashioned social engineering. The hackers gain entry into an employee’s account by sending them SMS messages that replicate an official text used by Robinhood for sending verification codes. It was revealed that the hacking occurred when an employee received and opened communications that seemed official but were actually fake.

This means that hackers could have gained access to all active users’ phone numbers and email addresses. One of the hackers shared a portion of the stolen information to Motherboard, which was verified by data brokers and security experts. Robinhood indicated that the hackers obtained a list of customer phone numbers, emails, and names. It was found that more than 300 people had their zip codes and dates of birth stolen from the company’s databases.

Even more concerning was the portion of social security numbers thought to be stolen from Robinhood’s database. However, it was later revealed that those numbers were not stolen in the list of phone numbers and emails. The hackers had total access to user accounts, as the company confirmed that the attack caused a system-wide data breach. With all this in mind, it’s safe to assume that hackers might use this data for identity theft and even financial scams.

Was all this avoidable?

There are a number of ways that Robinhood could have avoided the hacking. First, the company should have implemented two-factor authentication to protect its employees from falling victim to social engineering attacks. Second, it should have enforced proper security protocols, especially in end-user communications. In addition, there is a need for modern technology such as machine learning and AI models to ensure that the company is fully protected against cyber-attacks.

For instance, Robinhood sends SMS text messages to employees and users after requesting two-factor authentication, or when users need to take certain actions in their accounts. Hackers are well aware that these messages are used by the company’s employees, and they also know how to spoof them.

What is the best solution?

There is no longer an extra fee in trading stocks when investing through the Robinhood app, which helps you gain interest over time by investing in the stock market with the lowest fees available. However, the safety of your data is more important. To avoid this hacking incident from happening again, it is recommended that users seriously consider using two-factor authentication.

Captcha is a very effective type of data security. It provides a second level of security in addition to a username and password. For additional security, consider agent whitelisting and honeypot monitoring.

Address verification (AVS) is another security feature that you can enable on your Robinhood app. It’s important to consider adding this additional protection step for all financial apps that you use. Lastly, private cloud offers ultimate security for your organization. This level of data protection is essential when you are responsible for handling sensitive information that can impact or even jeopardize an organization.

The hacking incident involving Robinhood made a lot of investors panic and was made even worse by the hackers having access to personal information like user social security numbers. This particular case reminded businesses that no one is safe from this kind of threat; anyone can become a victim anytime, anywhere. However, these types of attacks are entirely preventable. All it takes is for companies to have an impeccable system that can prevent such attacks from happening. Sometimes, it just requires a little bit of effort and precautionary measures to be protected from cybercrimes.

How we can help on similar hacking issues

As data theft continues to prevail, companies need to take extra caution and invest heavily in data security. This is where Helpy.io can help to safeguard your data from being exposed.

Helpy.io is a private organization that specializes in cybersecurity, risk mitigation, and protection of your customers' data. We do regular testing on systems, especially for clients whose businesses involve sensitive information, such as financial institutions, insurance companies, and other related industries. We also provide services to secure your systems from possible hacking attempts with our wide-range of cybersecurity features such as private cloud and SSL technology.

We at Helpy.io have an expert team of internet engineers who specialize in helping companies with initial cybersecurity assessments and implementing data protocols to prevent such incidents from occurring.

We have helped numerous companies increase their security and prevent similar attacks from happening.  Our services that can help reduce similar cases by implementing the following security features:

Strong Passwords

Strict password policy enforcement forces use of multi-factor authentication for critical accounts. Password lifecycle management controls how and when a password can be changed. After several failed login attempts, the account will be locked out. This also includes monitoring for brute force attacks against your external facing services, such as the corporate email or VPN.

Agent Whitelisting

This is where you create a list of approved applications that are allowed to communicate with the infrastructure. It equally targets logins from specified IP addresses or addresses range. This can help prevent advanced malware from taking control of your infrastructure and encrypting your data.

Captcha

Captcha can reduce automated attacks against your login page and prevent click-jacking or other similar social engineering techniques from being successful.

Two-factor Authentication

This makes it harder for attackers to gain access to critical accounts, even when they have a stolen password or an OTP token. Two-factor authentication must be implemented using a security key device, such as a Yubikey, or Duo Security's new Authenticator app for Google and iOS devices.

Honeypot

A honeypot feature can be used to lure attackers and lead them towards a fake version of the actual production environment. The servers and services in the honeypots will be specially designed to alert you when they are attacked by your security monitoring system.

SSL Technology

Enhancing your web presence with SSL certificates can prevent attackers from being able to perform man-in-the-middle attacks against the traffic flowing between the website and users' browsers.

Data Compliance

A number of legal compliance standards require encryption to be used when transferring or storing sensitive data, such as PCI-DSS. This is especially the case with credit card information.

Attack Detection

You can use an advanced network security monitor to detect anomalies in the activity of computers on your local area network and alert you to suspicious activity.

If you want to take steps to protect your business, don't hesitate to contact us.

Users should always be on the lookout for phishing emails and avoid giving their credentials to any suspicious websites. It is important that users log out of accounts after each session, especially when using public internet connections. This will help secure accounts if anyone tries to access them while you are away from your desk. In a case where the breach has already happened, here is how you can easily communicate security breach notifications.