Industry News: ESG5

The target: Timehop, an application which aggregates old posts and photos from user’s social media feeds.

The take: Personal information including some combinations of name, e-mail address and phone number, to a total of 21 million records.

The attack vector: An account with administrative access to Timehop’s cloud computing environment was not protected with two-factor authentication – the attacker accessed the account, created a separate administrator credential for their own use in December of 2017. The attacker maintained access and performed reconnaissance for eight months until they proceeded to exfiltrate user data in July of 2018.

Read more...