Incident BriefingsMailchimp security incident

Mailchimp security incident

Social engineering of internal support tool (0ktapus-adjacent). Used to target crypto customers' mailing lists.

Last modified

Summary

  • Environment: Email marketing
  • Operational impact: Used to target crypto customers' mailing lists
  • Financial impact: No financial figure is established by the reviewed source evidence
  • Record status: Developing record. Reviewed September 19, 2026; updated as evidence emerges.

What happened

In 2022, Mailchimp experienced an incident in its email marketing environment. The retained source describes the attack path as follows: Social engineering of internal support tool (0ktapus-adjacent). [1]

The documented consequence was: Used to target crypto customers’ mailing lists. [1]

Impact

  • Documented impact: Used to target crypto customers’ mailing lists. [1]
  • No financial loss, ransom amount, recovery cost, or regulatory penalty is established by the reviewed source evidence.

Threat Group & Attack Vector

The retained source describes the attack path as follows: Social engineering of internal support tool (0ktapus-adjacent). The canonical record does not add intrusion steps beyond those supported by the source. [1]

Actors

  • 0ktapus — identified in the supported attack description. [1]

TTPs

  • No specific MITRE ATT&CK technique is currently mapped for this case.

Response

The reviewed source does not describe containment, notification, or restoration steps in enough detail to summarize them responsibly.

This account is bounded to March 2022 security incident. Details absent from that evidence are left unresolved rather than inferred. [1]