Tumblr hack affected 65.5 million users

Micro-blogging site seeks to reassure users after massive breach revealed

Tumblr has suffered a hacking attack that saw cyber criminals make off with the account data of a reported 65.5 million users.

The information, which includes email addresses and encrypted passwords, was "from 2013" according to a blog post by the Tumblr team.

While the blog post does not state when exactly the attack took place, Troy Hunt, who runs the site Have I Been Pwnd?, claims the data was exfiltrated on 28 February.

The blog post also does not reveal how many users have been affected, describing it simply as "a set", however, according to Hunt's information, the number is just under 65.5 million.

Furthermore, the data received by Hunt would also indicate that many of the accounts were deactivated at the time of the attack, as the email addresses begin with "deactivated" followed by a date before the email address proper. This is backed up by certain members of his mailing list being surprised to learn their data was included in the stolen information, as they thought they had "deleted" their account before the hack happened.

Steph Locke, lead data dcientist at CensorNet, told IT Pro: "The steady stream of database 'mega breaches' piled on top of smaller breaches from a variety of small and large companies continues to prove that every organisation is a target of cybercrime.

"It now becomes a question of how the stolen credentials will be, or have already been, used for nefarious purposes. With this breach being noted three years after [it] occurred, there has already been substantial opportunity for focussed attacks. Once the high-value targets have been hit, I expect we'll see a more 'all and sundry' approach - using the database for a mass spam / phishing campaign."

"Either way, people who use Tumblr should be extremely vigilant of emails received relating to Tumblr in the coming months," Locke cautioned.

IT Pro contacted Tumblr for comment regarding the volume of data stolen and related information produced by Hunt, but had not received a response at the time of publication.

Featured Resources

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Security best practices for PostgreSQL

Securing data with PostgreSQL

Download now

Transform your MSP business into a money-making machine

Benefits and challenges of a recurring revenue model

Download now

The care and feeding of cloud

How to support cloud infrastructure post-migration

Watch now

Recommended

Hackers leak data from dark web marketplace
cyber security

Hackers leak data from dark web marketplace

9 Apr 2021
Hackers are using fake messages to break into WhatsApp accounts
instant messaging (IM)

Hackers are using fake messages to break into WhatsApp accounts

8 Apr 2021
Hackers sell $38 million in gift cards on Russian marketplace
hacking

Hackers sell $38 million in gift cards on Russian marketplace

7 Apr 2021
Personal data of 533 million Facebook users found on hacking forum
data protection

Personal data of 533 million Facebook users found on hacking forum

5 Apr 2021

Most Popular

Microsoft is submerging servers in boiling liquid to prevent Teams outages
data centres

Microsoft is submerging servers in boiling liquid to prevent Teams outages

7 Apr 2021
Hackers are using fake messages to break into WhatsApp accounts
instant messaging (IM)

Hackers are using fake messages to break into WhatsApp accounts

8 Apr 2021
Alienware’s new gaming laptop is a kick in the teeth for Intel’s new CEO
Hardware

Alienware’s new gaming laptop is a kick in the teeth for Intel’s new CEO

8 Apr 2021