Timehop suffers data breach with 21 million users compromised

Lack of two-factor authentication saw usernames, email addresses, social media tokens and 4.7 million phone numbers taken

Social media app Timehop has fallen victim to a "network intrusion" that could have affected some 21 million of its users because it didn't have multi-factor authentication.

The app, which provides a nostalgia service by resurfacing old photos and posts by connecting to your social media profiles, said it's cloud computing environment was hacked and the usernames, email addresses and the phone numbers of some 4.7 million accounts were taken.

Advertisement - Article continues below

"At 2:04 US Eastern Time in the afternoon of the 4th of July 2018, Timehop observed a network intrusion," the company said in a statement on its website.

"The breach occurred because an access credential to our cloud computing environment was compromised. That cloud computing account had not been protected by multifactor authentication. We have now taken steps that include multi-factor authentication to secure our authorisation and access controls on all accounts."

Timehop said the attack was detected two hours and nineteen minutes later and engineers were able to lock the hackers out of the system, but a considerable data breach had already taken place by then.

"Access tokens" which are allocated to Timehop by social media providers were also taken and could allow malicious actors to view social media posts of other users without permission.

The company said the stolen tokens can no longer be used as they have been terminated, but stressed that the tokens could not give anyone access to Facebook messenger or direct messages on Instagram or Twitter.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

Timehop said it is continuing to investigate, but so far there had been no evidence to suggest any unauthorised access to users accounts.

Users of the service will have to login in again and re-authenticate each service they wish to use with Timehop which will generate a new token. For those that use a phone number as a login, Timehop recommends they take additional security precautions with their cellular provider.

According to a recent study, nearly two-thirds of organisations have admitted that they have still not implemented two-factor authentication. Although Gemalto's 2018 Authentication and Identity Management Index report found that adoption of two-factor authentication is increasing, just a third of staff are required to use it at the moment.

Picture: Shutterstock

Featured Resources

Successful digital transformations are future ready - now

Research findings identify key ingredients to complete your transformation journey

Download now

Cyber security for accountants

3 ways to protect yourself and your clients online

Download now

The future of database administrators in the era of the autonomous database

Autonomous databases are here. So who needs database administrators anymore?

Download now

The IT expert’s guide to AI and content management

Your guide to the biggest opportunities for IT teams when it comes to AI and content management

Download now
Advertisement

Recommended

Visit/security/cyber-security/355267/zoom-hires-ex-facebook-cso-to-boost-platform-security
cyber security

Zoom hires ex-Facebook CSO Alex Stamos to boost platform security

8 Apr 2020
Visit/security/vulnerability/355236/hp-support-assistant-flaws-leave-windows-devices-open-to-attack
vulnerability

HP Support Assistant flaws leave Windows devices open to attack

6 Apr 2020
Visit/security/cyber-security/355234/safari-bug-let-hackers-access-cameras-on-iphones-and-macs
cyber security

Safari bug let hackers access cameras on iPhones and Macs

6 Apr 2020
Visit/software/video-conferencing/355229/zoom-we-moved-too-fast
video conferencing

Zoom CEO admits company "moved too fast" as privacy issues mount

6 Apr 2020

Most Popular

Visit/mobile/mobile-phones/355239/microsofts-patent-design-reveals-a-mobile-device-with-a-third-screen
Mobile Phones

Microsoft patents a mobile device with a third screen

6 Apr 2020
Visit/server-storage/servers/355254/a-critical-flaw-in-350000-microsoft-exchange-remains-unpatched
servers

A critical flaw in 350,000 Microsoft Exchange remains unpatched

7 Apr 2020
Visit/software/video-conferencing/355257/taiwan-first-country-to-ban-zoom-amid-security-concerns
video conferencing

Taiwan becomes first country to ban Zoom amid security concerns

8 Apr 2020