2026 Kraken — insider-enabled access; ~2k accounts; extortion over screen recordings (Apr)
Data compromised
Limited customer profile fields visible in support tooling per company—exact field list in consumer notices
Technical writeup
In mid-April 2026, Kraken publicly described an extortion attempt after criminals used insider-facilitated access to internal support tools, threatening release of screen recordings that showed limited customer data fields. Bloomberg, CoinDesk, American Banker, and Yahoo Finance summarized the exchange’s position that roughly 2,000 client accounts (~0.02% of users) may have been viewed, no customer funds were at risk from the event, trading systems were not compromised, and staff complicity was identified with law-enforcement cooperation; Kraken stated it would not pay extortion demands. Company messaging characterized the root issue as unauthorized human misuse of access rather than a perimeter database breach, while still creating notification obligations for affected users.
Root cause
Insider-related misuse of internal customer-support access paths; social/engineering context in press
References
- https://www.coindesk.com/business/2026/04/13/crypto-exchange-kraken-targeted-in-extortion-attempt-but-says-there-was-no-breach-and-no-client-funds-at-risk
- https://www.bloomberg.com/news/articles/2026-04-13/kraken-says-criminal-group-claims-access-to-some-customer-data
- https://www.americanbanker.com/news/kraken-faces-extortion-threat-over-rogue-employee-breach
- https://finance.yahoo.com/markets/crypto/articles/criminals-blackmail-kraken-alleged-client-170836573.html