Metabase recently identified and disclosed an exploitation of a previously unknown software vulnerability in their platform. A threat actor leveraged this vulnerability to access data belonging to a number of Metabase customers, and Paradigm was among those affected.

‍

This security incident only affected Metabase’s systems. Paradigm’s own core infrastructure and services were not affected. Therefore, API keys on Paradigm were NEVER at risk. During the incident, the threat actor was able to access a subset of end-user data, including information you may have provided as part of our Know Your Customer verification processes such as email and mailing addresses, dates of birth, official government identification numbers, and other personal details.

‍

Upon learning of this incident, Paradigm took immediate steps to respond, remediate, and mitigate risk, including revoking and rotating security tokens and adopting the security measures and upgrades recommended by Metabase.

‍

In the meantime, we recommend users exercise caution with any unsolicited emails or communications they may receive, and be vigilant for credit and financial fraud and identity theft, as phishing attempts following incidents of this nature are not uncommon.

‍

If you have any questions or concerns, please do not hesitate to contact us at security@paradigm.co.

‍