Chainalysis discloses breach of customer contact data
https://sockanalyst.com/patch-now/chainalysis-breach

Splunk
index=email (subject="*Chainalysis*" OR subject="*Reactor*" OR subject="*password reset*") NOT src_user="*@chainalysis.com"
| stats count values(subject) as subjects by src_user, recipient

Sentinel
EmailEvents
| where Subject has_any ("Chainalysis","Reactor","password reset")
| where SenderFromDomain !endswith "chainalysis.com"
| summarize count(), make_set(Subject,10) by SenderFromAddress, RecipientEmailAddress, DeliveryAction