It is now the turn of Tumblr users to be worried. Apparently, the personal data of about 65 million users was hacked three years ago and is now being sold on the Internet. At the time Tumblr discovered the hack 3 years ago, they believed whoever stole the information won’t be able to do anything with the data. This is because of the special security measures adopted by Tumblr to prevent stolen data being used outside Tumblr.
But the chickens have come home to roost for Tumblr. The hackers have now found a way to make use of the stolen data. In a blog post about the issue, Tumblr said:
We recently learned that a third party had obtained access to a set of Tumblr user email addresses with salted and hashed passwords from early 2013, prior to the acquisition of Tumblr by Yahoo. As soon as we became aware of this, our security team thoroughly investigated the matter. Our analysis gives us no reason to believe that this information was used to access Tumblr accounts. As a precaution, however, we will be requiring affected Tumblr users to set a new password.”
Brief History of Tumblr
Tumblr is a microbloggging and social networking platfor founded in the US in 2007.The site is host to about 300 million blogs and the most recent traffic data show 550 million people visit the website monthly. Three years ago, at about the time the breached was discovered, Yahoo bought the company for a little over $1 billion. Did Yahoo had knowledge of the breach or was it kept from them?
Like the incident that occurred about two weeks ago when LinkedIn was hacked, the 60 million Tumblr users’ personal data can be bought, for just $150, from the same website that put up the LinkedIn data for sale. The dark website known as TheRealDeal is proving to be very prolific in the nuisance factor scale
In related development, the same user pawning these accounts also put up 360 million MySpace accounts and 40 million from the adult dating website known as fling.com. This is going to be really embarrassing for some users of fling.com.
These unfortunate events have made Troy Hunt well known these days. He is a seasoned online security expert with deep knowledge of hacked websites and security breaches. He does a yeoman job of tracking these breaches and informing victims of what is happening. Writing extensively about the issue in his blog, he said:
Over the period of this month, we’ve seen an interesting trend of data breaches. Any one of these 4 I’m going to talk about on their own would be notable, but to see a cluster of them appear together is quite intriguing.
For example, just yesterday I loaded the Fling database (you probably don’t want to go to fling dot com until you’re in a private setting). That was over 40 million records and the breach dates back to 2011.
A few days before that it was LinkedIn which has been pretty comprehensively covered in the press by now. There’s 164 million unique email addresses (out of about 167 million records in total), and that dates back to 2012.
Just now, I’ve finished loading tumblr into Have I been pwned (HIBP) with a grand total of over 65 million records dating back to 2013. That rounds out the total number of records loaded in just the last 6 days to 269 million, not that much less than I had in the entire system just a week ago. It’s also the second data breach I’ve personally appeared in over that period, my 6th overall. (Incidentally, you may see various different stats on the exact number of addresses in the tumblr breach due to data idiosyncrasies such as the way deactivated accounts were flagged.)”
Meanwhile if you are interested in knowing if you’ve being hacked, you can head over to Troy Hunt’s other website and find out. This website is building a very impressive data base of hacked accounts on different websites. Give it a shot if you have doubts about any of your accounts.
As for Tumblr users, they can go here to get additional information on how to keep their accounts secure.
photo credit: getlogdog.com; twitter.com