Disqus confirms 2012 hack of its comments tool

(graphic: file image)

Disqus has tested its internet commenting equipment became hacked.

The enterprise, which builds and gives a web-based mostly remark plugin for news websites, pointed out Friday that hackers stole more than 17.5 million electronic mail addresses in an information breach in July 2012.

About a 3rd of those money owed contained passwords, salted and hashed the usage of the weak SHA-1 algorithm, which has largely been deprecated in fresh years in choose of greater password scramblers. The information additionally contained sign-up dates and the date of the last login.

one of the exposed person advice dates returned to 2007.

lots of the money owed shouldn’t have passwords as a result of they signed up to the commenting device using a third-birthday celebration service, like facebook or Google.

The theft turned into handiest discovered this week after the database become despatched to Troy Hunt, who runs facts breach notification carrier Have I Been Pwned, who then informed Disqus of the breach.

The enterprise noted in a blog put up, posted under a day after Hunt’s inner most disclosure, that youngsters there became no evidence of unauthorized logins, affected clients should be emailed concerning the breach.

clients whose passwords were exposed may have their passwords drive-reset.

The enterprise warned clients who’ve used their Disqus password on other websites to exchange the password on those accounts.

“due to the fact 2012, as a part of standard security enhancements, we have now made colossal enhancements to our database and encryption to be able to avoid breaches and boost password safety,” noted Jason Yan, chief expertise officer, in the publish.

Yan observed that the company modified its password hashing to bcrypt, a a good deal enhanced password scrambler, in late 2012, and made other enhancements to enrich safety.

“Our group continues to be actively investigating this concern, but we desired to share all primary advice as quickly as viable,” noted Yan.

Daniel Ha, chief govt, informed ZDNet that the enterprise was looking into all dependable and imperative disclosures, with valued clientele and govt authorities.

Ha added that the stolen records represents less than 10 percent of the enterprise’s present person base. when you consider that the breach, the number of web page the usage of its platform has elevated through 5-fold, he mentioned.

The business says more than 50 million feedback are submitted the usage of its provider every month.

Disqus joins several different companies, like LinkedIn, MySpace, and Yahoo, who have in the past yr and a half revealed a historical statistics breach courting returned to the turn of the decade.

Hunt, a protection professional, praised the business’s response.

“within the house of less than 24 hours after first getting to know of the breach, Disqus has managed to assess the breach facts, establish a timeline of activities, reset passwords on impacted debts, craft a extremely transparent announcement and liaise candidly with the clicking,” stated Hunt.

“or not it’s a gold ordinary for responding to a protection incident and sets a very excessive bar for others to aspire to in future,” he added.

Hunt introduced that 71 % of electronic mail addresses had been already in Have I Been Pwned’s database of greater than four.7 billion records.

Latest topics for ZDNet in Security