[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Data Breaches](/category/data-breaches) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [How Did the Cash App Data Breach Happen?](/blog/how-did-the-cash-app-data-breach-happen) Publish date December 1, 2025 {x} minute read # How Did the Cash App Data Breach Happen? [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/complete-guide-to-data-breaches) [Free trial](/demo) Written by [Edward Kost](/team/edward-kost) Senior Cybersecurity Writer Edward is a cyber writer with a mechanical engineering background. His work has been referenced by academic institutions and government bodies. Reviewed by [Phil Ross](/team/phil-ross) Chief Information Security Officer Phil is a Forrester Zero Trust Strategist leveraging decades of experience in enterprise cybersecurity architectures. Table of contents eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) The Cash App data breach was caused by a former employee who accessed customer financial reports as an act of revenge against the company after their employment was terminated. According to the [April 2, 2022 filing with the Securities Exchange Commission](https://www.sec.gov/ix?doc=/Archives/edgar/data/0001512673/000119312522095215/d343042d8k.htm) by Block (CashApp’s parent company), the employee required access to the financial reports as part of their daily duties. After termination, on December 10, 2022,  the employee downloaded these reports without permission, stealing the following customer details. * Full names. * Brokerage Account numbers (unique identification numbers associated with a customer’s stock activity on Cash App Investing). * Brokerage portfolio values * Brokerage portfolio holdings  * Stock trading activity for one day of trading. [Cash App](https://www.upguard.com/security-report/cash-app) notified approximately 8.2 million current and former customers likely to have been impacted by the breach. Unfortunately, the delay of this breach notification - which was sent four months after the incident - prolonged the risk of follow-up cyberattacks targeting impacted customers. The negligence of this unnecessary delay, combined with a deficiency of basic security controls that could have prevented the breach, resulted in a [class action filing](https://www.classaction.org/media/salinas-et-al-v-block-inc-et-al.pdf) against Cash App Investing and its parent company, Block. > Defendant Block offered no explanation for the four-month delay between the initial discovery of the Breach and the belated notification to affected customers, which resulted in Plaintiffs and Class members suffering harm they otherwise could have avoided had a timely disclosure been made.\ > \ > \- Page 8 of [Class action filing](https://www.classaction.org/media/salinas-et-al-v-block-inc-et-al.pdf) against plaintiff BLOCK, INC., and CASH APP INVESTING, LLC, Cash App has had a tumultuous security history, primarily in the area of customer account compromise. Almost all online reviews for Cash App include complaints about account hacking and financial fraud, with some customers posting tweets about their account compromise experiences.  But the prevalence of account compromise attempts isn’t necessarily indicative of security vulnerabilities on the Cash App platform. Since the pandemic began, cybercriminals have been taking advantage of increasing concerns over the security of online funds by, ironically, fooling finance app users into falling for fraudulent account compromise messages leading to credential theft. Cash App’s security weakness lies in its poor response efforts during customer account hacks, a characteristic that’s highlighted in the company’s delayed breach notification following this latest insider threat breach. Sarah Jensen, the person who tweeted about their Cash App account being depleted overnight (see above), said that it was almost impossible to connect to a human Cash App customer service rep for support following the breach. Customers are given the option of contacting support via the app, but these requests are usually handled by bots rather than humans. > *“It's almost like an abusive relationship where you're trying to get a hold of somebody, and they’re completely ghosting you****.****”\ > \ > ‍*- Excerpt of [a conversation between Yahoo Finance and Sarah Jensen](https://www.yahoo.com/now/squares-cash-app-vulnerable-to-hackers-customers-claim-113556593.html?guccounter=1\&guce_referrer=aHR0cHM6Ly9tZWRpdW0uZGF0YWRyaXZlbmludmVzdG9yLmNvbS95b3UtY2FuLWdldC1oYWNrZWQtb24tY2FzaC1hcHAtYWZiYmY1NDIwYWNm\&guce_referrer_sig=AQAAANx1NG886pbT5ZdWLjeFj2A82BzytJKigOWUYeUbh3jcKcaik8m0o_pmUkUkrHMnYGrmrKzgPxXCwDsyrclCZanX8jZiKdCMbVk5qj0ztPC-oJ3nA4RZLJg-8wjLp0V-TfolZcLj0wyahky_MrKf1blxcG1PGxoauhv4376rvIMS), a Cash App account hack victim. See how your organization's security posture compares to Cash App's. [View Cash App's security report](https://www.upguard.com/security-report/cash-app). ‍ ## How to Prevent Falling Victim to a similar Data Breach The Cash App data breach was possible because a lack of essential security controls. By implementing these controls into your cybersecurity program, your business could avoid a similar fate. ## 1. Block Account Access for former and soon-to-be former Employees The Cash App breach could have been prevented if the terminated employee had immediately lost access to their accounts. IT teams should, ideally, be poised to block account access through [account management systems](https://www.upguard.com/blog/privileged-access-management) immediately following a termination notice - especially if an employee is likely to resort to retributive actions. The threat of malicious employees isn’t unique to Cash App. According to a survey by the Wall Street Journal, [almost 70% of companies](https://www.wsj.com/articles/companies-name-one-of-the-biggest-cybersecurity-threats-their-employees-11592606115) are concerned about the risk of insider threats. ## 2. Secure all Accounts with MFA To reduce login friction, and offer a better user experience, Cash App accounts don’t have passwords. Instead, whenever a user attempts to log in, they confirm their identity by submitting a verification code sent to their email or phone number. The problem with this login mechanism is that it could be exploited by compromising a victim’s email address. Given that most email addresses have already been compromised in major data breaches, and password recycling across multiple solutions is a bad habit most people have, this Cash App login pathway isn’t difficult to intercept. Many Cash App accounts can be found on dark web marketplaces, with listings including the associated email and password of the compromised Cash App account.  To prevent data breaches from occurring through exploited login pathways, all user accounts must be protected with MFA. If implementing an MFA protocol, be sure to account for [these common MFA bypass methods](https://www.upguard.com/blog/how-hackers-can-bypass-mfa). ## 3. Implement a Data Leak Detection Solution A [data leak](https://www.upguard.com/blog/data-leak) is an unknown exposure of [sensitive information](https://www.upguard.com/blog/sensitive-data), occurring through [software misconfigurations](https://www.upguard.com/breaches/power-apps) or data dumps on the dark web - like the Cash App listings on dark web marketplaces.  Dark web data leaks are the most common and also the most difficult category of data leaks to manage. Following a data breach, cybercriminals almost immediately list their bounty of stolen account details for sale on dark web marketplaces. Though these events are critical breaches of security, they’re not the most dangerous type of data leak because a payment gateway prevents unmitigated access to listings. The more serious type of data leak is when ransomware attackers freely publish stolen data on dark web blogs to punish victims that refuse to pay a ransom. This is what happened when [Medibank refused to yield](https://www.upguard.com/blog/what-caused-the-medibank-data-breach) to the extortion tactics of its attackers. With a ransomware blog data leak detection solution [like UpGuard](https://www.upguard.com/demo), your organization is instantly notified when sensitive credentials have been detected on ransomware blogs. This rapid awareness allows security teams to secure compromised credentials before they’re targeted in follow-up attacks. [Learn how to mitiagte the impact of ransomware attacks with ransomware blog data leak detection >](https://www.upguard.com/blog/protecting-employee-credentials-from-ransomware-compromise) eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) ## Related posts Learn more about the latest issues in cybersecurity. Attack Surface Management #### [Find Out if You're Exposed on the Dark Web](/blog/find-out-if-youre-exposed-on-the-dark-web) Answer 5 quick questions to predict what a dark web scan will find about your company. Then run the free scan to see your real exposure. [](/team/lance-turner) [Lance Turner](#) October 14, 2026 Data Breaches #### [Your First Dark Web Scan Report, Explained](/blog/your-first-dark-web-scan-report-explained) You scanned your domain. What do the results mean? [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Data Breaches #### [Good Security Rating? Your Dark Web Exposure Says Otherwise](/blog/good-security-rating-your-dark-web-exposure-says-otherwise) Scan your domain to see just how exposed you are on the Dark Web. [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Data Breaches #### [How to Prevent Data Breaches in 2026 (Highly Effective Strategy)](/blog/prevent-data-breaches) Learn how to implement an effective security control strategy for defending against data breaches in 2026. [](/team/edward-kost) [Edward Kost](#) October 26, 2026 Attack Surface Management #### [Attack Surface Management Vendors Compared](/blog/attack-surface-management-vendors-compared) We compared ASM vendors and helped you rate them before agreeing to a POC! [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Attack Surface Management #### [The Blind Spot in Brand Protection: Why App Stores Slip Past Standard Monitoring](/blog/the-blind-spot-in-brand-protection-why-app-stores-slip-past-standard-monitoring) Do Brand Protection Solutions scan the Apple App Store and Google Play? Don't wait to find out. [](/team/lance-turner) [Lance Turner](#) September 22, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)