Cash App company Block accepts being hit by a data breach where a former employee saved reports from Cash app containing US customer information. In a Security and Exchange Commission (SEC) filing on 4th April, Block (earlier names as Square)- told that the reports were downloaded by an insider on December 10. The employee could regularly access these files as part of his past job duties, however, in this case, these files were accessed without authorization after the competition of his job.
"Following its discovery of the incident four months after the fact, the company has launched an internal investigation and says it is notifying the applicable regulatory authorities and law enforcement. TechCrunch sent Block additional questions regarding the scope of the incident, but the company declined to answer," reports Tech Crunch. Block didn't respond to the issue, as to why a former employee still had access to the company data, and for how long did he have access to these files after his employment ended.
The information in these files includes the full names of the users and their brokerage account numbers. Besides this, the compromised data for a few customers include portfolio value, intraday stock trading activity, and brokerage portfolio holdings. Block, a company based in San Francisco didn't disclose how many Cash App customers were affected by the incident, however, around 8.2 Million current and former customers were impacted by the incident. According to the company, no other personal information like passwords, usernames, payment card info or addressees, or social security numbers were leaked in the report.
The filing mentions that other Cash App services and features and customers outside the US weren't affected by the incident. "At Cash App we value customer trust and are committed to the security of customers’ information. Upon discovery, we took steps to remediate this issue and launched an investigation with the help of a leading forensics firm. We know how these reports were accessed, and we have notified law enforcement. In addition, we continue to review and strengthen administrative and technical safeguards to protect information," says Danika Owsley, spokesperson for Cash App.
