Video streaming site Dailymotion has allegedly been breached, with the account details and email addresses of 85 million users taken. Dailymotion launched in 2005 and is currently the 113th most visited website in the world, according to Alexa rankings.
The Dailymotion hack was first reported by breach notification database LeakedSource and was apparently carried out around Oct. 20, Bleeping Computer reported. As many as 18 million hashed passwords were also taken, explained CSO, although experts suggested these were encrypted with bcrypt.
A security update was issued in the wake of the Dailymotion hack. The breach, which is the latest in a long line of incidents, is another stark reminder to IT managers about the potential impact of a security incident.
Experts Respond to the Dailymotion Hack
Ilia Kolochenko, chief executive of security firm High-Tech Bridge, told SC Magazine that an insecure web application was probably at the origin of the breach. Kolochenko expects to see “mass spear-phishing attacks combined with password reuse, which will allow cybercriminals to compromise many different accounts belonging to the victims.”
Javvad Malik, security advocate at AlienVault, told Wired that the Dailymotion hack served as a reminder that ” a company doesn’t need to hold financial information or any other form of overtly valuable data to be a target.”
Similar Security Incidents
Camelot Group, which operates the National Lottery in the U.K., suspended certain accounts recently after suspicious activity was spotted, Wired reported. The firm stressed there had been no unauthorized access to core National Lottery systems or databases.
The BBC, meanwhile, has presented U.K. broadband provider TalkTalk with evidence that many of its customers’ router credentials have been hacked, putting them at risk of data theft. TalkTalk confirmed the sample of stolen router IDs it had been shown was real.
Once again, these attacks stress that it’s not just banking or financial information that can be targeted. Cybercriminals are finding inventive ways of accessing data and using it to their advantage.
Advice for Users
The Dailymotion update, published on the site’s official blog, stated that a potential security risk might have comprised the passwords for a certain number of accounts. It also said the hack appeared to be limited and no personal data had been comprised.
As part of the update, Dailymotion issued security advice to its users: “Your account security is extremely important to us, and to be on the safe side, we are strongly advising all of our partners and users to reset their passwords.”
Dailymotion recommended users create new passwords with eight or more characters in a non-obvious pattern that had not been used on multiple sites. The site also reminded users that the best way to authenticate their apps or services is through the refresh-token method, which is a form of access with a limited lifetime.