The social media reminiscing platform, Timehop, revealed yesterday that an attacker had accessed an internal database on their cloud on July 4th, and stole personal data on 21 million users. Fortunately, the breach was mostly limited to names and usernames, but 4.7 million of the victims also had their phone numbers exposed. The hacker was also able to access “tokens” that are used to view users’ posts, but the company quickly deactivated them. Timehop’s investigation revealed that the hacker laid the groundwork in mid-December by using an “authorized user’s credentials to create a new administrative user account that could access Timehop’s Cloud Computing Environment.” The hacker then used that account several times as a reconnaissance before his July 4th attack. Timehop discovered the breach while it was still in progress and reacted very quickly to mitigate it. The company reiterated that they were able to stop the attack before the hacker was able to access any “memories,” or other personal data, but some features are still unavailable as an “overabundance of caution” while the investigation continues.
