JP Buntinx reports:
The name LoanBase might ring a bell for most Bitcoin users as the company has been around for quite some time, albeit under a different name. Until a few months ago, this company was known under the name BitLendingClub, but the LoanBase rebranding gives the service a more professional appeal to users not versed in the world of Bitcoin and digital currency.
Late last night, Loanbase sent out an email to their users, informing them regarding a breach of the platform. Four different user accounts have been tampered with, and the expected loss of funds sits at eight Bitcoin. However, that number could be as high as 20 BTC once the internal investigation has been completed successfully.
Read more on The Merkle.
The text of the email reportedly sent to users was posted to reddit:
Loanbase Security Breach
We’ve discovered that there was a security breach, which resulted in the loss of roughly around 8 BTC. At this stage this is an estimate based on the confirmed breach of 4 user accounts. The maximum amount which may have been lost does not exceed 20 BTC. We detected that the unauthorized access of the user accounts occurred early in the morning on February 6th and continued throughout the day. For more information, please see below.
Here is what we know about the hack at this stage:
4 accounts were confirmed to be compromised. The accounts compromised did not have two-factor authentication enabled. The hackers did not gain access to the Bitcoin wallets. The breach occurred via a security hole in the WordPress blog (we will provide more details later). The hackers did gain access to our SQL database, this means that sensitive user information may have been leaked, such as: e-mail addresses, phone numbers, names, etc.
Will the funds be reimbursed to those that had an unauthorized withdrawal? Yes, we will return all the funds of the users who have had an unauthorized withdrawal.
What’s next? We’re going to take the following steps: We’ve taken down the website for a security update. All of the passwords have been reset. Any withdrawals which were approved, but not processed yet, will all be rejected. We’re going to implement additional security procedures, which will help with an earlier detection of such breaches. Once we bring the website up, we will request that our users change their passwords and update their TFA.
When will the website be up? Our team is working overtime, so we hope that it shouldn’t take us more than 24 hours. We’ll keep everybody posted via e-mail, Twitter and Facebook.