Celsius Network LLC, et all., Notice of Commencement, Email Address Compromise by Customer.io, and Official Documentation Release, Case No. 22-10964 (MG)

As part of the restructuring process, we are required to send out certain legal documents to all stakeholders, including our customers.

You may have received or will soon be receiving an email with the first of these legal documents, called the Notice of Commencement. This is a standard document intended to provide you with information about the court proceedings and key upcoming dates and deadlines. No action is required on your part.

Information will be available throughout the process on our case website (https://cases.stretto.com/celsius). If you have questions, you can call +1 (855) 423-1530 (U.S.) or +1 (949) 669-5873 (international) or email celsiusinquiries@stretto.com.

We are writing to let you know that we were recently informed by our vendor Customer.io that one of their employees accessed a list of Celsius client email addresses held on their platform and transferred those to a third-party.

We do not consider the incident to present any high risks to our clients whose email addresses may have been affected but are releasing this communication to make sure you are aware.

We have been in ongoing communication with Customer.io. They have confirmed that no other Celsius-related data was compromised beyond those identified email addresses.      

To state clearly, Celsius’ systems and security had not been involved or impacted. Celsius’ robust security and data protection management, and our focus on protecting our clients’ data, remain intact.

Context

On 30 June 2022, Celsius identified that one of its vendors, Customer.io, had been involved with a data breach connected to OpenSea. Celsius proceeded to remove all data held with Customer.io. We quickly contacted Customer.io and they responded that, as of that time, no Celsius data had been involved in their breach. Celsius requested all details surrounding the incident.

On 8 July 2022, Customer.io informed us that one of their employees had accessed a list of Celsius client email addresses from Customer.io’s platform, along with lists from several of their clients, and transferred these lists to a third-party bad actor. Customer.io confirmed that, other than the identified email addresses, no other Celsius client data was accessed or taken by the employee.

Evidence of this incident has not yet been provided to us by Customer.io. 

    

Customer.io made a public statement on the matter

https://customer.io/blog/update-to-compromised-email-addresses-incident/.

          

Further Information    

Celsius sees this as a severe violation of vendor-client relations, and we have notified the appropriate authorities. Again, we do not consider the incident to present any high risks to our clients whose email addresses may have been affected. Should you wish to contact us for further information regarding the incident, please contact our data protection officer, Charles Roberts, at security@celsius.network for further information.

              

Sincerely,

Celsius

Note: Celsius will never ask you for private keys or to send funds to external addresses. Always verify that you’re interacting with the celsius.network domain when receiving emails from us.