Timehop suffers data breach with 21 million users compromised

Lack of two-factor authentication saw usernames, email addresses, social media tokens and 4.7 million phone numbers taken

Social media app Timehop has fallen victim to a "network intrusion" that could have affected some 21 million of its users because it didn't have multi-factor authentication.

The app, which provides a nostalgia service by resurfacing old photos and posts by connecting to your social media profiles, said it's cloud computing environment was hacked and the usernames, email addresses and the phone numbers of some 4.7 million accounts were taken.

"At 2:04 US Eastern Time in the afternoon of the 4th of July 2018, Timehop observed a network intrusion," the company said in a statement on its website.

"The breach occurred because an access credential to our cloud computing environment was compromised. That cloud computing account had not been protected by multifactor authentication. We have now taken steps that include multi-factor authentication to secure our authorisation and access controls on all accounts."

Timehop said the attack was detected two hours and nineteen minutes later and engineers were able to lock the hackers out of the system, but a considerable data breach had already taken place by then.

"Access tokens" which are allocated to Timehop by social media providers were also taken and could allow malicious actors to view social media posts of other users without permission.

The company said the stolen tokens can no longer be used as they have been terminated, but stressed that the tokens could not give anyone access to Facebook messenger or direct messages on Instagram or Twitter.

Timehop said it is continuing to investigate, but so far there had been no evidence to suggest any unauthorised access to users accounts.

Users of the service will have to login in again and re-authenticate each service they wish to use with Timehop which will generate a new token. For those that use a phone number as a login, Timehop recommends they take additional security precautions with their cellular provider.

According to a recent study, nearly two-thirds of organisations have admitted that they have still not implemented two-factor authentication. Although Gemalto's 2018 Authentication and Identity Management Index report found that adoption of two-factor authentication is increasing, just a third of staff are required to use it at the moment.

Picture: Shutterstock

Featured Resources

BIOS security: The next frontier for endpoint protection

Today’s threats upend traditional security measures

Download now

The role of modern storage in a multi-cloud future

Research exploring the impact of modern storage in defining cloud success

Download now

Enterprise data protection: A four-step plan

An interactive buyers’ guide and checklist

Download now

The total economic impact of Adobe Sign

Cost savings and business benefits enabled by Adobe Sign

Download now

Recommended

The ultimate guide to landing a cybersecurity career
Careers & training

The ultimate guide to landing a cybersecurity career

30 Sep 2020
8 of the most secure web browsers
web browser

8 of the most secure web browsers

25 Sep 2020
Your essential guide to internet security
Security

Your essential guide to internet security

23 Sep 2020
How to enable private browsing on any device
privacy

How to enable private browsing on any device

22 Sep 2020

Most Popular

16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
Nokia will replace Huawei as BT's largest 5G equipment provider
5G

Nokia will replace Huawei as BT's largest 5G equipment provider

29 Sep 2020