Allium, a blockchain data provider serving financial and cryptocurrency companies, has disclosed unauthorized access to some of its systems, prompting an investigation, API key revocations and temporary restrictions on uploaded data.

The company detected the security incident on October 25, according to an update published by CEO and co-founder Ethan Chan on October 28. Allium said it immediately restricted access, took steps to secure its systems and notified affected customers directly.

The company has engaged an independent cybersecurity firm to support the investigation. However, it has not disclosed which systems were accessed, how the intrusion occurred or whether customer data was exposed.

Allium’s core services, including the Allium App, Explorer and Explorer APIs, have since returned online. Some features remain unavailable as the company continues its recovery efforts.

The incident has also prompted Allium to revoke existing API keys and temporarily disable access to previously uploaded data.

Allium revokes API keys after unauthorized access

In its October 28 security update, Allium confirmed that an unauthorized party had accessed certain systems.

The company has not publicly identified the attacker or provided technical details about the intrusion. It said the independent cybersecurity firm would help investigate the incident and strengthen security controls, particularly authentication and monitoring.

As a precaution, Allium is revoking existing API keys. Customers must create new keys through the application to restore API access unless their Allium contact is providing replacement credentials directly.

The company has also asked users to set new passwords when they next sign in and recommended enabling multi-factor authentication.

Access to uploaded data remains temporarily disabled. Customers cannot upload new data or access previously uploaded datasets, and queries that depend on those tables will not run until the functionality is restored.

Allium Assistant and its Model Context Protocol (MCP) service were also unavailable in the company’s October 28 recovery notice.

These restrictions are part of the company’s response to the incident. Allium has not said that every affected feature was itself compromised.

Core services return as recovery continues

Allium’s public status page records service disruptions beginning on October 25, when the company initially described an Explorer outage as maintenance.

On October 26, Allium took its application offline as a precaution while it worked to restore services. The Explorer and Explorer API were subsequently brought back online on October 28.

However, restoring access to the application does not mean every service or dataset has fully recovered.

Allium also experienced disruptions to data feeds delivered to customers through cloud data platforms, including Snowflake, Databricks and Google BigQuery. The company reported that data delivery had resumed, while verification and backfilling continued for affected data.

That work is important for customers who depend on complete blockchain records for analytics, transaction monitoring and other business operations. An API may be available even while some datasets are still being checked for gaps.

As of the latest updates reviewed for this article, Allium had not published a complete account of the security incident or confirmed whether any customer information had been accessed.

What the breach means for Allium’s customers

Allium provides infrastructure for collecting, organizing and querying blockchain data. Its services help companies turn onchain activity into structured information that can be used for analytics, research and financial applications.

Its work has been associated with major firms including Visa, Stripe and Coinbase. Visa’s public Onchain Analytics Dashboard, for example, identifies Allium as its data provider.

However, the breach disclosure does not say that these companies’ own systems were accessed. The confirmed incident concerns unauthorized access to certain Allium systems, and the company has not named the affected customers publicly.

The distinction is important because a breach at a third-party provider does not automatically mean that its customers have also been compromised.

The potential impact will depend on which systems the attacker reached, what data those systems contained and whether any credentials or customer information were exposed. Allium has not yet provided enough detail to establish those outcomes.

The temporary service restrictions may also affect customers that rely on uploaded datasets or features that remain offline. The company’s recovery updates indicate that some functionality is still being restored.

Allium plans to share investigation findings

Allium said it is strengthening its security controls, including authentication and monitoring, as part of its response.

The company plans to publish a summary of its investigation and the measures taken after the investigation is complete. Until then, important questions remain unanswered, including how the unauthorized access occurred, which systems were affected and whether customer data was exposed.

For customers, the immediate steps are to follow Allium’s instructions for replacing API keys, reset account passwords and enable multi-factor authentication. Customers should also check the company’s official status page for updates on service availability and data recovery.

The incident highlights the security risks that can arise when businesses depend on third-party infrastructure providers. Blockchain data platforms play an important role in analytics, payments and digital-asset services, but they also need strong access controls and clear incident-response processes.

For now, Allium’s core services are back online, but the full impact of the breach remains unknown. The company’s final investigation findings should provide a clearer picture of what happened and whether customer data was affected.

Read also: Nestcoin: Building crypto-native financial tools for Africa