---
title: "Chainalysis customer-profile data incident"
description: "Chainalysis confirmed unauthorized access to customer profile information and continued assessing affected records."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-10-31"
canonical_url: "https://www.ally.security/incidents/chainalysis-customer-profile-data-incident-2026"
markdown_url: "https://www.ally.security/incidents/chainalysis-customer-profile-data-incident-2026.md"
stix_url: "https://www.ally.security/incidents/chainalysis-customer-profile-data-incident-2026/stix.json"
---

# Chainalysis customer-profile data incident

Names, emails, user IDs and role labels were accessed; sensitive investigation data was not known to be affected.

Last modified Oct 31, 2026 · 1 source

## Summary

- **Environment:** Chainalysis internal systems and tools
- **Operational impact:** No service interruption established in the public notice
- **Financial impact:** No confirmed incident cost quantified

## What happened

[Chainalysis](https://www.chainalysis.com/) detected an external actor accessing internal systems during October 2026. Its October 30 disclosure confirmed access to customer profile information. [1](#source-1)

## Impact

Accessed fields included user IDs, names, email addresses and organization-role labels. The affected-record total remained under investigation. Chainalysis had no indication of access to investigation cases, graphs or notes, transaction/query results, cleartext passwords, MFA secrets or session tokens. [1](#source-1)

## Timeline

### October 30, 2026 — Profile-data access disclosed

The [security notice](https://www.chainalysis.com/blog/security-incident-october-30/) describes confirmed fields and the continuing scope assessment. [1](#source-1)

### October 31, 2026 — Briefing updated

This briefing was last reviewed and updated on October 31, 2026.

## Threat Group & Attack Vector

Chainalysis described the use of offensive agentic techniques, but did not establish the precise exploit path or actor identity. It explicitly separated this incident from the reported Binance theft. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

The company patched vulnerabilities, notified all customers and engaged outside experts. It recommended two-factor authentication and caution about targeted phishing. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/chainalysis-customer-profile-data-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Security Incident October 30

official · Chainalysis · Oct 30, 2026

<https://www.chainalysis.com/blog/security-incident-october-30/>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Occurred At · 100% confidence · current**  
   Customer-profile access publicly disclosed: 2026-10-30
2. **Resulted In · 100% confidence · current**  
   Chainalysis customer-profile data incident: Customer-profile access publicly disclosed
3. **Resulted In · 100% confidence · current**  
   Chainalysis customer-profile data incident: Chainalysis described offensive agentic techniques and said it patched vulnerabilities; it did not publicly establish a precise exploit path or actor identity.
4. **Disclosed At · 100% confidence · current**  
   Chainalysis customer-profile data incident: 2026-10-30
5. **Resulted In · 100% confidence · current**  
   Chainalysis customer-profile data incident: Chainalysis said it detected an external actor accessing internal systems and tools during October 2026; the exact access and detection dates were not disclosed.
6. **Affected Organization · 100% confidence · current**  
   Chainalysis customer-profile data incident: Chainalysis
7. **Resulted In · 100% confidence · current**  
   Chainalysis customer-profile data incident: Chainalysis confirmed access to customer user IDs, full names, email addresses and organization-role labels.
8. **Resulted In · 100% confidence · current**  
   Chainalysis customer-profile data incident: As of its October 30 notice, Chainalysis had no indication of access to investigation graphs, notes or cases, transaction or query results, cleartext passwords, MFA secrets or session tokens.
9. **Resulted In · 100% confidence · current**  
   Chainalysis customer-profile data incident: Chainalysis proactively notified all customers while continuing to determine affected records and working with outside experts. It recommended two-factor authentication and vigilance against targeted phishing.
10. **Resulted In · 100% confidence · current**  
   Chainalysis customer-profile data incident: Chainalysis explicitly said this incident was unrelated to the separately reported Binance theft.

</details>