Social media app Timehop has fallen victim to a "network intrusion" that could have affected some 21 million of its users because it didn't have multi-factor authentication.
The app, which provides a nostalgia service by resurfacing old photos and posts by connecting to your social media profiles, said it's cloud computing environment was hacked and the usernames, email addresses and the phone numbers of some 4.7 million accounts were taken.
"At 2:04 US Eastern Time in the afternoon of the 4th of July 2018, Timehop observed a network intrusion," the company said in a statement on its website.
"The breach occurred because an access credential to our cloud computing environment was compromised. That cloud computing account had not been protected by multifactor authentication. We have now taken steps that include multi-factor authentication to secure our authorisation and access controls on all accounts."
Timehop said the attack was detected two hours and nineteen minutes later and engineers were able to lock the hackers out of the system, but a considerable data breach had already taken place by then.
"Access tokens" which are allocated to Timehop by social media providers were also taken and could allow malicious actors to view social media posts of other users without permission.
The company said the stolen tokens can no longer be used as they have been terminated, but stressed that the tokens could not give anyone access to Facebook messenger or direct messages on Instagram or Twitter.
Timehop said it is continuing to investigate, but so far there had been no evidence to suggest any unauthorised access to users accounts.
Users of the service will have to login in again and re-authenticate each service they wish to use with Timehop which will generate a new token. For those that use a phone number as a login, Timehop recommends they take additional security precautions with their cellular provider.
According to a recent study, nearly two-thirds of organisations have admitted that they have still not implemented two-factor authentication. Although Gemalto's 2018 Authentication and Identity Management Index report found that adoption of two-factor authentication is increasing, just a third of staff are required to use it at the moment.
Picture: Shutterstock
