Freepik data breach: Hackers stole 8.3M records via SQL injection

guest · Aug 21, 2020

Freepik data breach: Hackers stole 8.3M records via SQL injection
August 21, 2020
https://www.bleepingcomputer.com/ne...-hackers-stole-83m-records-via-sql-injection/

Freepik says that hackers were able to steal emails and password hashes for 8.3M Freepik and Flaticon users in an SQL injection attack against the company's Flaticon website.

Freepik is the company behind Freepik (one of the largest online graphic resources sites in the world) and Flaticon (an icon database platform) totaling 18 million monthly unique users, 50 million monthly views, and 100 million monthly downloads.

The threat actors behind the Freepik security breach were able to steal the oldest 8.3M users' emails and password hashes, where available.

"To clarify, the hash of the password is not the password, and can not be used to log into your account," Freepik added.
Click to expand...

229K MD5 salted passwords reset after breach
"Out of these 8.3M users, 4.5M had no hashed password because they used exclusively federated logins (with Google, Facebook and/or Twitter), and the only data the attacker obtained from these users was their email address," the company added.

3.55 million users had their email addresses and passwords' bcrypt hashes harvested and exfiltrated by the attackers, while for roughly 229,000 users the attackers got MD5 salted passwords hashes.
Freepik now uses bcrypt to hash all user passwords
"Those who had a password hashed with salted MD5 got their password canceled and have received an email to urge them to choose a new password and to change their password if it was shared with any other site (a practice that is strongly discouraged)," Freepik explained.
Click to expand...

Log in or Sign up

Freepik data breach: Hackers stole 8.3M records via SQL injection

guest Guest

Log in or Sign up

Freepik data breach: Hackers stole 8.3M records via SQL injection

guest Guest

Useful Searches