Chainalysis Takes Reactor and Data Solutions Offline Amid Cyber Threats

Chainalysis took Reactor and Data Solutions offline Monday, Nov. 2, as it responded to continuing cyber threats, disrupting two services while its compliance transaction-monitoring products remained available. The latest step follows earlier coverage of the incident.

Chainalysis disclosed that user IDs, full names, email addresses and labels showing organizational roles had been accessed. The company was still working to identify exactly which records were involved.

In its Nov. 2 update, the company reported no indication that investigation content or transaction and query results had been accessed. It also found no evidence of access to plaintext passwords, multifactor authentication secrets or user session tokens.

The disclosure alone does not establish that users are owed compensation under the European Union’s General Data Protection Regulation (GDPR). Article 82 allows compensation for material or nonmaterial damage caused by a GDPR infringement. The Court of Justice of the European Union has said a claimant must establish an infringement, damage resulting from it and a causal link. It also has ruled that nonmaterial damage does not need to meet a minimum level of seriousness.

In separate guidance on security safeguards, the court has said unauthorized access alone does not prove a company failed to use appropriate protections. It places the burden on the organization responsible for the data to show its measures were suitable.

Germany’s Federal Court of Justice addressed nonmaterial damage on Nov. 18, 2024, in a case involving Facebook data scraping. The dispute involved personal information from about 533 million users that was publicly circulated in April 2021. The court found that a short-lived loss of control over personal information can qualify as nonmaterial damage, even without proof that the data was misused or caused other significant negative effects. For the circumstances before it, the court said compensation near €100 would not be legally objectionable.

The court did not award €100. It partly set aside the Cologne appeals court ruling and returned the case for further proceedings, so the figure was not a fixed GDPR payout or minimum.

The GDPR can reach businesses based outside the EU when they offer goods or services to people in the bloc or monitor their behavior there. That territorial rule alone does not settle whether the law covers specific Chainalysis records or every affected user.