Approximately 7 million email addresses were exposed, including those of high-profile influencers, companies, and key opinion leaders (KOLs).
The breach did not happen on OpenSea's own infrastructure but at its email vendor, Customer.io. A senior engineer misused their access to download and share user email addresses with an unauthorized party.
The specific archive file mentioned has been spotted in Telegram channels, purportedly containing the full list of exposed records for use in targeted phishing campaigns. Associated Phishing Threats
Following the circulation of this data, OpenSea users reported a surge in sophisticated phishing attempts. Common tactics include: Wave of Phishing Attacks Possible with OpenSea Data Breach