Vendor incident, severity medium
Chainalysis breached via "offensive agentic techniques"; customer names and emails accessed
Published
Chainalysis disclosed that an external actor used "offensive agentic techniques" to gain unauthorized access to its internal systems and tools earlier in October 2026. Accessed customer data includes user IDs, full names, email addresses and organizational role labels. The company says it has found no evidence that investigation content, authentication credentials or session tokens were accessed, and it is still determining which records were affected for each organization.
What's affected
- chainalysisevery version
What to do
- Enable two-factor authentication on Chainalysis accounts
- Watch for unexpected password reset requests and authentication prompts
- Be wary of anyone impersonating Chainalysis, especially offering fund recovery or recruiting services
- Watch for Chainalysis updates on which records were accessed for your organization
Check whether you were affected
Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:
/pharon:check-incident chainalysis-data-breach-2026-10References
Notice chainalysis-data-breach-2026-10, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.