21 Million Users Affected by Timehop Data Breach

21 Million Users Affected by Timehop Data Breach

Timehop disclosed a security breach that has compromised the personal data, including names and emails, of its 21 million users

Timehop, a memory sharing smartphone app, disclosed a security breach that has compromised the personal data, including names and emails, of its 21 million users. Around a fifth of the affected users (4.7 million) have also had a phone number that was attached to their account breached in the attack.

Timehop is a smartphone application designed to resurface old posts from several social media accounts including Facebook, Twitter, Instagram and Google accounts as well as iCloud photos and videos.

The startup said it discovered the attack on July 4 as it was happening and was able to shut it down two hours later, but not before the data of millions was stolen.

According to the preliminary investigation of the incident, the attacker first accessed Timehop's cloud environment in December, using compromised admin credentials, and observed the system for a few days that month and then again in March and June before launching the attack on the 4th.

Timehop publically disclosed the breach in a blog post on Saturday and notified all users through the app on Monday morning. The app says no social media posts were breached during the attack, and the blog emphasizes that none of the content its service lifts from third party social networks was affected.

"With breaches happening every day, it’s nice to see an organization take steps which will help post-breach beyond the free year of credit card monitoring that has become the norm," Travis Smith, principal security researcher at Tripwire said. "Timehop took the time to understand the scope of the breach and what was impacted. This allowed them to deactivate the access keys which the attacker appeared to have been after."

While the social media posts were not affected, the keys that allow Timehop to read the posts were. Users will have to re-authenticate their social media platforms with the app in order to see their memories.

In order to protect the cloud computing environment from future attacks, the startup is implementing multifactor authentication to secure authorization and access controls on all accounts that did not previously have them.

“There is no such thing as perfect when it comes to cyber security but we are committed to protecting user data," the blog post read. "As soon as the incident was recognized we began a program of security upgrades.”

About the Author

Sydny Shepard is the Executive Editor of Campus Security & Life Safety.

Featured

  • Just as Expected

    GSX produced a wonderful tradeshow earlier this week. Monday was surprisingly strong in the morning, and the afternoon wasn’t bad at all. That’s Monday’s results and asking attendees to travel on Sunday. Just a quick hint, no one wants to give up their weekend to travel and set up an exhibit booth. I’m just saying. Read Now

    • Industry Events
    • GSX
  • Allied Universal Report Highlights Expected Security Hazards

    All is not well with the world. I know that is not breaking news. Read Now

    • Industry Events
    • GSX
  • NOLA: The Crescent City

    Twenty years later we finds ourselves in New Orleans. Twenty years ago the aftermath of Hurricane Katrina forced exhibitors and attendees to look elsewhere for tradeshow floor space. Read Now

    • Industry Events
    • GSX
  • Nothing Artificial About this Intelligence

    I have been looking forward to this year’s GSX show in New Orleans, the Cresent City, or if you prefer The Big Easy. It seems like quite a while since we’ve been here. Twenty years ago, ASIS, as it was known then was literally washed out of the city by someone known as Katrina. It is a good thing to come back to NOLA. Read Now

  • From Monitors to Mission Control

    Security Operations Centers (SOC) were once defined by rows of static monitors, each displaying a single feed with operators quietly watching for issues. That model has become obsolete. Incidents evolve too quickly, data comes from multiple locations, and decisions must be made in seconds—not minutes. Read Now

New Products

  • Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

    Connect ONE®

    Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

  • 4K Video Decoder

    3xLOGIC’s VH-DECODER-4K is perfect for use in organizations of all sizes in diverse vertical sectors such as retail, leisure and hospitality, education and commercial premises.

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area.