TrueUSD Faces Data Exposure in Third-Party Security Breach

Stablecoin issuer TrueUSD recently experienced a third-party security breach, resulting in the exposure of personally identifiable information for some of its clients. The breach has raised alarms, potentially affecting clients who joined the platform between 2018 and 2019. 

The compromised data includes crucial information like names, email addresses, phone numbers, and bank details.

The breach has been traced back to TrueCoin, a former service provider for TrueUSD, responsible for critical functions such as banking, customer onboarding, and product management. TrueCoin alerted TrueUSD about the breach after a third-party vendor flagged an unusual account change within its organization, hinting at a compromised support vendor.

TrueCoin informed TrueUSD about the breach after a third-party vendor discovered an “anomalous account change” within TrueCoin’s organization, indicating the compromise of a support vendor, TrueUSD said in an X thread on Monday.

TUSD team was informed by TrueCoin that they received a third-party vendor's notification that the vendor’s Security Team detected “an anomalous account change within [TrueCoin’s] organization made by a compromised support vendor.”

— TrueUSD (@tusdio) October 16, 2023

TrueUSD users are encouraged to contact the stablecoin issuer if they detect unusual activity.

The breach occurred on September 20, 2023, and set off immediate investigations by TrueCoin’s cybersecurity and engineering teams to evaluate the extent of the breach. 

Fortunately, the internal IT infrastructure of TrueCoin remained uncompromised. However, the breach exposed a wide range of sensitive information including addresses, birth dates, transaction histories, and public blockchain wallet addresses.

Swift Actions and Client Advisory

TrueCoin and TrueUSD acted swiftly to prevent unauthorized access and urged affected clients to exercise vigilance and monitor their accounts for any suspicious activity. They emphasized caution against potential phishing attacks and encouraged clients to report unusual occurrences.

“TrueCoin was engaged as TUSD operator until 13 Jul 2023, they hold certain [know-your-customer] and transaction history data of TUSD users, and part of the data was potentially exposed to the attacker during the attack suffered by TrueCoin’s third-party vendor,” the team said.

It’s worth noting that TrueUSD clarified that neither their internal systems nor those of TrueCoin were directly compromised. The breach occurred at the level of a third-party vendor used by TrueCoin for various services, raising concerns about third-party vulnerabilities in the fintech space. 

TrueUSD để lộ thông tin khách hàng

Khách hàng của TrueUSD đã nhận được email cảnh báo về một vi phạm bảo mật có thể đã xâm phạm thông tin nhận dạng cá nhân của họ.

Tối ngày 16/10/2023, TrueUSD, nhà phát hành TUSD – stablecoin được hỗ trợ bởi Justin Sun và… pic.twitter.com/NEb9tdbBul

— TA DUY BAC (⚖️,🌍) 🚀MATR1XCoin 🐐 🐉 $MON Tabi 🟧 (@binancedomain) October 16, 2023

Notably, the full extent of the breach remains unclear as the third-party vendor could not confirm whether the attacker downloaded, altered, or removed personal information from its systems.

While the present case revolves around an SEC complaint against Terraform Labs, it’s worth noting that the SEC initiated a distinct case against Genesis in January. Genesis sought to have the case dismissed in May, and as per recent updates, the case appears to be ongoing.

Despite this security breach, TrueUSD’s stablecoin remains unaffected and maintains its relative parity with the U.S. dollar, currently trading at $1. TrueUSD holds a significant position in the realm of USD-pegged stablecoins, showing the necessity for continued efforts to fortify data security and privacy in the cryptocurrency ecosystem.