MailChimp suffered a data breach last year after cyber attackers exploited an internal company tool to gain access to customer accounts. The criminals were able to look at around 300 accounts and exfiltrate data on 102 customers. They also accessed some customers’ AIP keys, which would have enabled them to send email campaigns posing as those customers.
Six months later, it happened again. As before, an intruder accessed internal tools to compromise data on 133 MailChimp accounts. The breach was made possible by a social engineering attack on employees and contractors to gain access to employee passwords.
The experience of getting attacked more than once in a similar manner as a previous attack isn’t rare. In fact, it’s very common. Here's why it happens.