Timehop Service Suffers Data Breach Affecting 21 Million Users [Updated]

The company behind social media app Timehop has revealed its servers suffered a data breach in which the personal details of around 21 million users were stolen.

The company, whose service integrates with users' social media accounts to display photos and memories they may have forgotten about, said it became aware of the attack as it was happening in the early hours of July 4.

In a statement published on Saturday, the company said it was able to shut down its cloud servers two hours and twenty minutes into the attack, but not before a significant number of users' data was stolen.

Hackers made off with the names and emails of 21 million users and the phone numbers of 4.7 million users, but no private/direct messages, financial data, social media, photo content, or Timehop data including streaks were affected, according to the company.

However, the keys that enable the service to read and send social media content to users were compromised in the breach. Timehop has deactivated the keys as a security measure, but that means users will need to re-enable the app's permission to access their accounts if they want to continue using the service.
While we investigate, we want to stress two things: First: to date, there has been no evidence of, and no confirmed reports of, any unauthorized access of user data through the use of these access tokens.

Second, we want to be clear that these tokens do not give anyone (including Timehop) access to Facebook Messenger, or Direct Messages on Twitter or Instagram, or things that your friends post to your Facebook wall. In general, Timehop only has access to social media posts you post yourself to your profile. However, it is important that we tell you that there was a short time window during which it was theoretically possible for unauthorized users to access those posts - again, we have no evidence that this actually happened.
Notably, Timehop admitted that prior to the breach, the account login process on the compromised cloud server was not protected by multi-factor authentication.

Multi-factor authentication protocols are often used by companies handling large customer databases because they provide hardened security during login attempts by requesting that the user provides extra information only they would know.

The company said it had now reset all its passwords and added multi-factor authentication to all its cloud server accounts, and would continue to work with local and federal law enforcement officials to investigate the incident further.

Update 7/11: Timehop has disclosed that more user information was compromised in the same data breach, including date of birth and gender.



Top Rated Comments

(View all)
Avatar
10 weeks ago
You know you’re old when 21 million people use something you’ve never even heard of.
Rating: 12 Votes
Avatar
10 weeks ago
Amazeballs on so many levels. Storing user data unencrypted. They hadn’t been bothered to add MFA before but were able to do so in just a couple of days AFTER the breach. And the attackers got access to auth tokens.

Here’s some lessons kids. Don’t use the login with Facebook feature. Ever. The two seconds of convenience you’ll save just makes Facebooks data collection even more pervasive and pernicious.

Consider whether you really *need* any of these services. Consider whether you should really be connecting anything to social media accounts. Finally go to Facebook right now and try to understand the bizarro privacy settings. Download your data. Check out apps you’ve connected and delete ones you don’t use, recognize, or remember. And consider disabling the “Facebook Platform” option altogether.
Rating: 8 Votes
Avatar
10 weeks ago
I shouldn't care, but I'm laughing myself into a hemorrhage over this.

I told my ex (and her BFF, and I think also his BF) numerous times to turn that garbage off, especially since Failbook and Google Photos have this exact feature built in (and since they're all millennials, FB and Snapchat are all they use).

I do feel bad that 21 million people had to suffer due to this particular posterior bite from Karma, however.
Rating: 6 Votes
Avatar
10 weeks ago

Is there a forum / wiki with a master list of breaches like this one?


There was... but it was hacked and all the information was stolen

/jk
Rating: 4 Votes
Avatar
10 weeks ago

Is there a forum / wiki with a master list of breaches like this one?

https://haveibeenpwned.com/
Rating: 2 Votes
Avatar
10 weeks ago

lol, my ex's best friend forever, (whom she would have probably left me for, if it weren't for the fact that) he is gay and has a boyfriend. Ergo the use of BFF and BF.

Either way they're just android plebs, no matter how smart they like to think they are.


:)
Rating: 1 Votes
Avatar
10 weeks ago


>I told my ex (and her BFF, and I think also his BF)

This one just doesn't compute to me. I guess you mean her BF.


lol, my ex's best friend forever, (whom she would have probably left me for, if it weren't for the fact that) he is gay and has a boyfriend. Ergo the use of BFF and BF.

Either way they're just android plebs, no matter how smart they like to think they are.
Rating: 1 Votes
Avatar
10 weeks ago

I shouldn't care, but I'm laughing myself into a hemorrhage over this. I told my ex (and her BFF, and I think also his BF)


I'd like to look at it the other way around. The principle, buyer be ware, is what de facto counts when it comes down to it. Goes for your marriage as well as using internet services. If basic security protocols are not in place. Consider something else. And if you have no idea what you are getting into, consider a backup plan.

Combine greedy unethical service providers with trusting (ignorant and gullible) users and that's the current situation.

>I told my ex (and her BFF, and I think also his BF)

This one just doesn't compute to me. I guess you mean her BF.

You know you’re old when 21 million people use something you’ve never even heard of.


I'm 22 and have never heard of it. My friends use social media too, and I used to. Could just be regional.

[doublepost=1531210381][/doublepost]

Is there a forum / wiki with a master list of breaches like this one?


Here is one buddy. Or what I assume you actually ask for. *already posted

https://haveibeenpwned.com
Rating: 1 Votes
Avatar
10 weeks ago

You know you’re old when 21 million people use something you’ve never even heard of.

My first thought, verbatim, when I saw the headline!
Rating: 1 Votes
Avatar
10 weeks ago
It is not enough that so much personal data is given up by people on Facebook and other social media, they actually fall for a company that "puts it all together" with a selling slogan "Sharing Is Caring!"?

Love the fact that it is "local".
Rating: 1 Votes
[ Read All Comments ]