Anatomy of a High-Profile Data Breach: Dissecting the Aftermath of a Crypto-Wallet Case

TL;DR

This study investigates the downstream effects of data breaches on crypto-wallet users, revealing new attack vectors, victim concerns, and implications for cybersecurity practices through a survey of affected individuals.

Contribution

It provides a detailed case study of a crypto-wallet data breach, highlighting new attack methods and victim responses, and discusses methodological challenges in breach research.

Findings

Common nuisances like spam and phishing increased

New attack vectors involving tampered devices identified

Victims show heightened safety concerns and skepticism

Abstract

Media reports show an alarming increase of data breaches at providers of cybersecurity products and services. Since the exposed records may reveal security-relevant data, such incidents cause undue burden and create the risk of re-victimization to individuals whose personal data gets exposed. In pursuit of examining a broad spectrum of the downstream effects on victims, we surveyed 104 persons who purchased specialized devices for the secure storage of crypto-assets and later fell victim to a breach of customer data. Our case study reveals common nuisances (i.e., spam, scams, phishing e-mails) as well as previously unseen attack vectors (e.g., involving tampered devices), which are possibly tied to the breach. A few victims report losses of digital assets as a form of the harm. We find that our participants exhibit heightened safety concerns, appear skeptical about litigation efforts, and demonstrate the ability to differentiate between the quality of the security product and the circumstances of the breach. We derive implications for the cybersecurity industry at large, and point out methodological challenges in data breach research.