Phishing Attack Exposes 16,627 Subscriber Records from Troy Hunt’s Mailchimp List
What Happened – In March 2025 a phishing email successfully compromised Troy Hunt’s Mailchimp account. The attacker used the compromised credentials to export the entire subscriber list, exposing 16,627 records that included email addresses, IP addresses, latitude/longitude pairs and time‑zone data.
Why It Matters for Trust & Control Assurance
- Highlights the need for strong identity and access controls (MFA, credential rotation) on third‑party SaaS accounts.
- Demonstrates why continuous monitoring of privileged account activity and immutable audit logs are essential for defensible evidence.
- Shows that security‑awareness training remains a critical control to reduce successful phishing attempts.
Who Is Affected – Newsletter publishers, security‑research community members, and any organization that relies on email‑marketing platforms to store subscriber data.
Recommended Actions
- Immediately rotate all credentials for third‑party email‑marketing services and enforce multi‑factor authentication.
- Enable detailed activity logging and integrate logs into a centralized SIEM for continuous monitoring.
- Conduct a targeted security‑awareness refresher focused on phishing detection for all users with SaaS admin rights.
Technical Notes – Attack vector: phishing email that harvested the Mailchimp admin password. No vulnerability in Mailchimp itself was exploited; the breach resulted from credential compromise. Exposed data types: email address, IP address, geographic coordinates (latitude, longitude) and derived time‑zone information. Source: [Have I Been Pwned – Troy Hunt Mailchimp breach]