OpenSea has confirmed being impacted by a third-party security breach, marking the third attack against the major non-fungible token marketplace following a third-party hack and phishing incident in June 2022 and February 2022, respectively, SiliconAngle reports.
Attackers behind the most recent intrusion may have compromised application programming interface keys, said OpenSea, which urged users to immediately replace such keys, which are set to expire on Oct. 2. Such an incident is indicative of poor design on the part of OpenSea, according to Cequence Security Hacker in Residence Jason Kent.
"If the data repository is accessible and the keys are compromised a perfect storm exists where the data can be acquired by a malicious third party. Rotating these keys is extremely important, it should happen early and often," Kent added.
Disclosure of the OpenSea attack comes just days after cryptocurrency analytics firm Nansen announced being hit by a third-party breach. No correlation between both incidents has been discovered so far.
"The Company's investigation of the incident remains ongoing. Based on the Company's current knowledge of the facts and circumstances related to this incident, the Company believes that this incident is not material," said Dick's in a filing with the Securities and Exchange Commission.
While Microchip has not provided any comment regarding the claims, Play's admission a full week after the company's breach disclosure to the Securities and Exchange Commission reveals an extension from the 72-hour deadline given for a ransom payment.
Attackers with unauthorized VPN access were able to infiltrate Park'N Fly's network between July 11 and July 13, enabling the theft of individuals' names, mailing and email addresses, and Canadian Automobile Association and Aeroplan numbers.
Get daily email updates
SC Media's daily must-read of the most current and pressing daily news