Cyber incident at crypto company Bits of Gold: customers' personal details may have leaked
Bits of Gold reported a data breach involving stolen customer details like full names, IDs, emails, IP addresses, and phone numbers. The company confirmed that funds, coins, passwords, ID copies, and credit card details were unaffected.
Crypto company Bits of Gold reported today (Sunday) on a cyber incident that occurred several days ago, in which information on customer details was apparently stolen, such as full name, ID number, email and IP addresses, and phone number. In other words, information was stolen that could be used for "phishing"-type fraud. The company emphasized that customers' money and coins were not harmed, nor were passwords, ID photocopies, and credit card details. It noted that the company's customers should be vigilant regarding approaches from third parties, including attempts to impersonate official entities.
The cyber incident at Bits of Gold is part of a broader cyber incident worldwide, in which there was a breach at a software company that Bits of Gold uses. According to estimates, there are hundreds of companies around the world that were affected, while at this stage no additional Israeli company is known [to have been affected]. Therefore, the assessment is that Bits of Gold was not a direct target of the attack.
The company's customers received a message from the company stating:
"A few days ago, we identified unauthorized access to a support system for data analysis, as part of a large-scale cyber incident that also affected other companies worldwide. Upon identifying the incident we blocked the access and disconnected the system from the information sources, so that this access has ended. Our security team has begun a comprehensive review of the incident, accompanied by a company specializing in investigating and responding to cyber incidents. We have also updated the relevant authorities, and we continue to review the incident and monitor the systems."
In the message to customers, the company emphasized:
"Your digital assets and funds are safe and were not involved in the incident. Additionally, we do not hold our customers' private keys, full credit card details, or CVV codes, and therefore this information was not involved in the incident. In addition, your account access passwords and the scan of your ID document were not exposed. The company's services continue to be provided as usual, normally and fully."
Regarding the question of what information is at risk of leaking, the company wrote to customers:
"The review so far indicates that there may have been access to certain personal information, including name, contact and identifying details (such as ID number, email, and phone), IP address, bank account details, and public crypto wallet address. At this stage there is no indication that this information has been used. What's important to do now? There is no need to take any action on your account. However, as a precautionary measure, since personal details may have been exposed, we recommend being vigilant regarding impersonation attempts, phishing, and suspicious messages. In light of the incident, there is a possibility that you will be approached by an unauthorized party using these details. Refrain from providing any details to any approach of this kind. Do not click on suspicious links, provide personal information or verification codes, or carry out a transfer of money or digital assets in response to any approach made to you."
The company further emphasized:
"Similar to other financial entities, [the company] will never ask you to provide a password, verification code, or private key, and will not ask you to transfer money or digital assets to another wallet."
Bits of Gold is the first currently active company among nine companies that received a license to trade in cryptocurrencies from Israel’s Capital Market Authority; it employs about 55 employees and serves about 300 thousand registered customers. The company recently signed a cooperation agreement with the Paz Group, under which it will be possible to purchase coins at the company via the Yellow wallet. The company's official response to media contains all the information included in the customer message noted above.
