Inyova
en en
Back

Tech tips: Heartbreaking Robinhood story 

Inyova’s short monthly newsletter about security recommendations, news, and interesting facts.

This is an internal newsletter sent to the Inyova team each month. We hope you enjoy it as much as we do!

Today’s topic: Heartbreaking Robinhood story 

What happened?

In November 2021, Robinhood, an online financial services company, reported a data breach affecting 5 million customers’ email addresses, another 2 million customers’ full names, and a detailed data breach of a small customer group.

They have been breached by a social engineering attack.

What the hack is a social engineering attack? 

A social engineering attack is an attack where the attacker claims they are someone else, in order to get any information that could be used for their advantage. 

In the Robinhood case, the attacker lied to a customer service representative and managed to get access to Robinhood’s internal tool. There the attacker could not only see emails and names but also balances, buying power, IP addresses, support communications, phone numbers, 2FA activation, and more.

Why should I care?

The Robinhood incident was a human error that often happens when employees lack deeper security knowledge about possible dangers and traps out there. It’s very hard to fix such a problem, as you need to tutor people on how to not become a victim. 

At Inyova, we need to constantly be aware of these threats and share any social engineering attacks we encounter with the rest of the team.

What should I do? 

Firstly, do not share any access if you are not entitled to do so. Do not share access with employees you do not know or those who should already have access. You can protect yourself by delegating this responsibility to your team’s lead.

Secondly, restrict yourself from sharing direct links to internal tools, and watch out not to share internal tools on any video screen sharing or any screenshots.

If you are under a social engineering attack, share this information with the whole team.

 

That’s it! Keep your mechanics safe and thanks for reading.

Source: https://blog.robinhood.com/news/2021/11/8/data-security-incident

 

Disclaimer: Past performance of financial markets and instruments is never an indicator of future performance. The statements or information contained in this document do not constitute a recommendation, offer, or solicitation to buy or sell any security or financial instrument. Inyova AG assumes no liability whatsoever with regard to the reliability and completeness of the information contained in this article. Liability claims regarding damage caused by the use of any information provided, including any kind of information which is incomplete or incorrect, will therefore be rejected. Furthermore, the statements contained in this document reflect an assessment at the time of publication and are subject to change. References and links to third party websites are outside the responsibility of Inyova AG. Any responsibility for such websites is declined.
You might also like:
Tech tips: Credential stuffing attack
Tech tips: Massive ransomware increase
Inyova AG Limmatstrasse 123 8005 Zurich
Apple Store Download from
Apple Store Google Store Download from
Google Store
Inyova AG Limmatstrasse 123 8005 Zurich

Inyova’s impact investing approach uses methods based on the provision of additional capital (project bonds in Inyova Grow and green bond funds in Inyova Invest) and active ownership (Inyova Invest). The share of impact-oriented investments depends on the client-specific portfolio and can be between 20% and 90%. Details can be found here or by contacting our customer success team.

© 2025 — Inyova AG
Select your language and country
Choose the country of your residence to learn more about our offering for you.