Robinhood hackers reportedly gained access to an internal tool that can alter accounts and remove security settings

Robinhood confirmed earlier this week that it suffered a “data security incident” allowing hackers to obtain millions of email addresses and full names. It now appears that the hackers may have also gained access to an internal tool that they can use to change account settings remotely.

Screenshots proving that hackers got into a Robinhood internal tool that can tweak user accounts were obtained by Motherboard a few days after the company confirmed the data breach. The publication says the screenshots came from someone claiming to be a “proxy” for the hackers. One of the screenshots attached in the report, though most of its content was redacted for obvious reasons, shows a panel of “Login Controls” with options to use for altering account settings.

The tool shows the user’s preferred method of login authentication. Based on the obtained screenshot, anyone who has access to the Robinhood internal tool in question can use it to disable MFA or multi-factor authentication, add a trusted device, log out an account, or even “revoke” a password.

The page also contains detailed user activity with lists of the token hash, device ID, device type, location, and IP addresses used per session. The same screenshot shows that the tool could give remote access to other sensitive information, such as a Robinhood user’s buying power, balances, and tax info. The same page also contains an account holder’s username, email address, and phone number with indicators if they have been verified.

“Certain authorized Robinhood employees have the ability to update accounts as necessary to provide customer support or service accounts, as is standard at most financial institutions and platforms,” the company told Motherboard. Robinhood also said its investigation shows the hackers did not use the hacked tool to tweak any user account.

The release of the screenshots happened just a few days after Robinhood confirmed the hacking incident. The data breach occurred “late in the evening” on Wednesday, Nov. 3, by using a “socially engineered” customer support staff, which was then used to access the company’s customer support systems.

In an announcement on Monday, Robinhood said the hackers obtained five million email addresses and two million full names. “We also believe that for a more limited number of people—approximately 310 in total—additional personal information, including name, date of birth, and zip code, was exposed, with a subset of approximately 10 customers having more extensive account details revealed.”

Photo by Andrew Neel on Unsplash