Timehop Breach Hits 21 Million Customers

Marco Green
July 9, 2018

"To reiterate: none of your "memories" - the social media posts & photos that Timehop stores - were accessed", Timehop said in a statement. Timehop engineers began to block the attack and lock down the compromised environment less than two hours after the attack began, the company says.

No financial data, private messages, direct messages, user photos, user social media content, social security numbers, or other private information was breached.
We learned of the breach while it was still in progress, and were able to interrupt it, but data was taken.

The attacker also grabbed access tokens and keys, which let Timehop access and display your posts from the likes of Twitter, Instagram and Facebook.

The breach affected 21 million users, including their names, some email addresses, and approximately 4.7 million phone numbers attached to their accounts. This unauthorized user created a new administrative user account, and began conducting reconnaissance activities within our Cloud Computing Environment.

Timehop has disclosed a security breach that has compromised the personal data (names and emails) of 21 million users (essentially its entire user base).

Some data was breached. Another thing the hackers got were the "keys" that allow the app to show you posts from the sources you've chosen. "We have now taken steps that include multifactor authentication to secure our authorization and access controls on all accounts".

The company said it has reset all its keys out of "abundance of caution", which will require users to re-authenticate their Timehop accounts before again using its service.

If you have noticed any content not loading, it is because Timehop deactivated these proactively.

In its blog about the incident, Timehop says that at the same time as it was working to shut down the attack and tighten up security, company executives contacted local and federal law enforcement officials - presumably to report the breach.

The idea is that the app turns every day into an anniversary, reminding you of what you were doing on this day last year, three years ago, five years ago, and so on.

"That cloud computing account had not been protected by multifactor authentication".

As of now, Timehop claims that there is no evidence of the stolen data being used. Following the attack, a number of new security measures have been introduced, including system-wide multi-factor authentication (many people will be concerned that this was not already in place).

For now, by way of explanation, it writes: "There is no such thing as flawless when it comes to cyber security but we are committed to protecting user data". We will employ the latest encryption techniques in our databases.

Timehop has also provided a more detailed breakdown of the attack if you want to lean more about what happened.

Other reports by Click Lancashire

Discuss This Article