Snapchat data breach: 4.6M accounts exposed
Severity: medium · Patch status: no-fix-needed · Since 2014-01-02
In January 2014 just one week after Gibson Security detailed vulnerabilities in the service, Snapchat had 4.6 million usernames and phone number exposed. The attack involved brute force enumeration of a large number of phone numbers against the Snapchat API in what appears to be a response to Snapchat's assertion that such an attack was "theoretical". Consequently, the breach enabled individual usernames (which are often used across other services) to be resolved to phone numbers which users usually wish to keep private. Exposed data: geographic locations, phone numbers, usernames. The breach dates from Jan 1, 2014; Have I Been Pwned loaded it on Jan 2, 2014.
What to do
- If you had a Snapchat account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
