Chainalysis, a company providing blockchain analysis services to law enforcement and financial institutions, announced that a recent cyberattack compromised sensitive account data for every user on its platform. The breach, initially disclosed on October 30, was later confirmed to be more extensive, affecting all customers' names, usernames, password hashes, and live tokens. The company has not publicly identified the perpetrators of the attack.The incident involved what Chainalysis described as "offensive agentic techniques" used by an external actor to gain unauthorized access to its systems and internal tools. While Chainalysis initially linked the breach to an "industry-wide rise in AI-driven cyberattacks," it did not explicitly state that its own systems were compromised by an AI agent. The company also reported an "on-path attack" that exposed a subset of customer passwords. An on-path attack, often referred to as a man-in-the-middle attack, involves an attacker intercepting communications between a user and a service to read or alter traffic.Following the discovery, Chainalysis engaged third-party cybersecurity experts to investigate the incident and strengthen its defenses. The company has since taken several key services offline, including the Know Your Transaction (KYT) user interface and API, other address screening products, and its login page, citing abnormal activity and an abundance of caution. All impacted accounts have been locked, and users are required to reset their passwords and rotate API keys. Chainalysis advised customers to visit its login page directly rather than using links in password-reset emails, a common tactic in phishing attempts.Despite the broad exposure of credentials, Chainalysis stated that it has found no evidence that any investigations data was accessed or that its attribution data was manipulated. The company's services are used by over 1,500 customers, including those in law enforcement, national security, cryptocurrency, and traditional finance sectors. The integrity of attribution data is particularly critical, as it feeds into legal and investigative work, including asset freezes and seizures.Chainalysis continues to investigate the full scope of the data breach. The company has not specified whether every category of information was exposed for every user, nor has it disclosed the total number of affected users. The company's updates have widened the picture of the breach since its initial disclosure, prompting customers to remain vigilant for unexpected authentication prompts and password reset requests, and to ensure multi-factor authentication is enabled.