7 Million Robinhood Users Hit by Data Breach

A Phone Call That Exposed Millions

On November 3, 2021, an unknown hacker targeted the American trading platform Robinhood, compromising data belonging to approximately 7 million users. The breach was not carried out through sophisticated technical exploits — instead, the attacker used social engineering, manipulating a customer support employee over the phone to gain access to the company's internal systems.

What Data Was Stolen

The breach exposed email addresses belonging to around 5 million users, while approximately 2 million users had their full names stolen. A smaller group of roughly 310 customers also had their names, dates of birth, and zip codes exposed. For about 10 customers, more extensive account details were compromised.

Despite the scale of the breach, Robinhood stated that critical financial data remained intact. No Social Security numbers, bank account numbers, or debit card details were accessed, and the company confirmed that no customers suffered financial losses as a result of the incident.

Extortion Attempt and Investigation

After Robinhood contained the breach, the attacker attempted to extort payment from the company. Both U.S. law enforcement authorities and cybersecurity firm Mandiant were brought in to investigate the incident.

The case remains unsolved. This attack is a stark reminder of how cyberattacks can be launched not through code, but through human manipulation — a tactic that continues to pose a serious threat to companies worldwide.

Robinhood publicly disclosed the breach on November 9, 2021, six days after the attack took place.