Blink: software bug allowed several dozen accounts to be drained; data for another ~3400 users was accessible to the attacker

The vendor has confirmed that on September 19 an outsider withdrew funds from several dozen accounts through a vulnerability in its own software. Affected users' balances have been restored to their pre-incident state, and they have been notified directly. The attacker also gained access to account information for about 3400 other users — according to the vendor, no funds were withdrawn from those accounts, and names, documents and addresses were not affected. The leaked account information is a ready-made list for targeted phishing posing as support.