2021–2022 Block (Square parent) — former employee Cash App Investing report download (~8.2M)
Data compromised
Names, brokerage account numbers, portfolio and trading-activity fields per Block notifications
Technical writeup
Block, Inc. (parent of the Square seller ecosystem and Cash App) disclosed that after a former employee’s December 2021 departure, they had downloaded internal reports containing U.S. Cash App Investing customer information—roughly 8.2 million individuals in SEC-filed narratives. Data included full names, brokerage account numbers, and in some summaries portfolio value, holdings, and stock-trading activity; company statements emphasized no exposure of bank-account credentials, payment-card data, Social Security numbers, or usernames/passwords in that disclosure. BreachHistory also lists the same underlying incident under the Block legal entity (`block-cashapp2022`).
Root cause
Insider access to post-employment corporate reporting exports