Personal information from more than 65m Tumblr accounts has been discovered for sale on the darknet.
Tumblr disclosed the leak, which it says took place in early 2013, this month, but had not previously acknowledged the scale of the database that was compromised.
The database includes email addresses and passwords, but the latter are heavily protected: Tumblr salted and hashed the passwords, a procedure which renders it practically impossible to restore the passwords to a useable state. It has since turned up for sale on darknet marketplace The Real Deal, with a sale price of just $150, according to Motherboard’s Lorenzo Franceschi-Bicchierai.
“As soon as we became aware of this, our security team thoroughly investigated the matter,” the company said in a statement on 12 May. “Our analysis gives us no reason to believe that this information was used to access Tumblr accounts. As a precaution, however, we will be requiring affected Tumblr users to set a new password.”
Troy Hunt, a security researcher who runs the Have I Been Pwned site, which records database leaks and notifies the victims, writes that the leak is good example of a new type of breach: “historical mega breaches”.
Hunt has recorded 269m individual compromised accounts in the past week, and notes that a MySpace database ostensibly containing 360m records is also for sale online, but none of the sites involved was breached more recently than three years ago. “This data has been lying dormant – or at least out of public sight– for long periods of time,” Hunt says.
Users who fear that their credentials were involved in the Tumblr hack can find out at Hunt’s site. Tumblr recommends that affected users change their password, and those in the database should also be on particular lookout for phishing attacks over the coming weeks and months.
No comments:
Post a Comment