21 Million Users Affected by Timehop Data Breach

21 Million Users Affected by Timehop Data Breach

Timehop disclosed a security breach that has compromised the personal data, including names and emails, of its 21 million users

Timehop, a memory sharing smartphone app, disclosed a security breach that has compromised the personal data, including names and emails, of its 21 million users. Around a fifth of the affected users (4.7 million) have also had a phone number that was attached to their account breached in the attack.

Timehop is a smartphone application designed to resurface old posts from several social media accounts including Facebook, Twitter, Instagram and Google accounts as well as iCloud photos and videos.

The startup said it discovered the attack on July 4 as it was happening and was able to shut it down two hours later, but not before the data of millions was stolen.

According to the preliminary investigation of the incident, the attacker first accessed Timehop's cloud environment in December, using compromised admin credentials, and observed the system for a few days that month and then again in March and June before launching the attack on the 4th.

Timehop publically disclosed the breach in a blog post on Saturday and notified all users through the app on Monday morning. The app says no social media posts were breached during the attack, and the blog emphasizes that none of the content its service lifts from third party social networks was affected.

"With breaches happening every day, it’s nice to see an organization take steps which will help post-breach beyond the free year of credit card monitoring that has become the norm," Travis Smith, principal security researcher at Tripwire said. "Timehop took the time to understand the scope of the breach and what was impacted. This allowed them to deactivate the access keys which the attacker appeared to have been after."

While the social media posts were not affected, the keys that allow Timehop to read the posts were. Users will have to re-authenticate their social media platforms with the app in order to see their memories.

In order to protect the cloud computing environment from future attacks, the startup is implementing multifactor authentication to secure authorization and access controls on all accounts that did not previously have them.

“There is no such thing as perfect when it comes to cyber security but we are committed to protecting user data," the blog post read. "As soon as the incident was recognized we began a program of security upgrades.”

About the Author

Sydny Shepard is the Executive Editor of Campus Security & Life Safety.

  • ONVIF is Reaching New Heights ONVIF is Reaching New Heights

    In this episode of SecurPod, Ralph C. Jensen and Leo Levit talk about the organization’s addition of GitHub and the milestone of more than 20,000 conformant products, as well as two Release Candidates. We also talk about the challenges ONVIF faced during this COVID-19 year and the biggest challenges they have faced.

Digital Edition

  • Security Today Magazine - May June 2021

    May June 2021


    • Tapping into Touch-free Digital
    • Deep Learning
    • Working from Home
    • Body-worn Technology
    • A Tragic Turn of Events

    View This Issue

  • Environmental Protection
  • Occupational Health & Safety
  • Infrastructure Solutions Group
  • Spaces4Learning
  • Campus Security & Life Safety