Social media app Timehop has fallen victim to a "network intrusion" that could have affected some 21 million of its users because it didn't have multi-factor authentication.
The app, which provides a nostalgia service by resurfacing old photos and posts by connecting to your social media profiles, said it's cloud computing environment was hacked and the usernames, email addresses and the phone numbers of some 4.7 million accounts were taken.
"At 2:04 US Eastern Time in the afternoon of the 4th of July 2018, Timehop observed a network intrusion," the company said in a statement on its website.
"The breach occurred because an access credential to our cloud computing environment was compromised. That cloud computing account had not been protected by multifactor authentication. We have now taken steps that include multi-factor authentication to secure our authorisation and access controls on all accounts."
Timehop said the attack was detected two hours and nineteen minutes later and engineers were able to lock the hackers out of the system, but a considerable data breach had already taken place by then.
"Access tokens" which are allocated to Timehop by social media providers were also taken and could allow malicious actors to view social media posts of other users without permission.
The company said the stolen tokens can no longer be used as they have been terminated, but stressed that the tokens could not give anyone access to Facebook messenger or direct messages on Instagram or Twitter.
Timehop said it is continuing to investigate, but so far there had been no evidence to suggest any unauthorised access to users accounts.
Users of the service will have to login in again and re-authenticate each service they wish to use with Timehop which will generate a new token. For those that use a phone number as a login, Timehop recommends they take additional security precautions with their cellular provider.
According to a recent study, nearly two-thirds of organisations have admitted that they have still not implemented two-factor authentication. Although Gemalto's 2018 Authentication and Identity Management Index report found that adoption of two-factor authentication is increasing, just a third of staff are required to use it at the moment.
Picture: Shutterstock
-
AI is helping bad bots take over the internetNews Automated bot traffic has surpassed human activity for the first time in a decade, according to Imperva
-
Two years on from its Series B round, Hack the Box is targeting further growthNews Hack the Box has grown significantly in the last two years, and it shows no signs of slowing down
-
Microsoft Authenticator mandates number matching to counter MFA fatigue attacksNews The added layer of complexity aims to keep social engineering at bay
-
As Google launches passwordless authentication for all, what are the business benefits of passkeys?News Google follows Apple in its latest shift to passwordless authentication, but what are the benefits?
-
There's only one way to avoid credential stuffing attacksOpinion PayPal accounts were breached last year due to a credential stuffing attack, but can PayPal avoid taking responsibility?
-
Google Authenticator 2FA update accused of making service less secureNews Lack of end-to-end encryption in code backup has some developers worried
-
Five things to consider before choosing an MFA solutionIn-depth Because we all should move on from using “password” as a password
-
What is multi-factor authentication (MFA) fatigue and how do you defend against attacks?In-depth Strong authentication is key to security, but it needs to be properly managed to avoid MFA fatigue
-
Beyond Identity strikes up strategic partnership with World Wide TechnologyNews WWT will implement Beyond Identity’s authentication platform internally while also acting as a global channel partner
-
Implementing strong authentication across your businessIn-depth Strong authentication is hugely important, but implementing any regime at scale is not without its challenges
