Disqus, the company behind the popular comment platform with the same name, announced that some its servers were breached and user information from a 2012 user database was stolen. The information dated back to 2007 and included email addresses, Disqus usernames, sign-up dates, and last login dates in plain text for 17.5 million users.
Passwords from about a third of the users were also stolen, but they were hashed with the now deprecated SHA1 algorithm, which means the attackers would still need to crack these passwords through brute-force in order to use them. Disqus announced the breach within 24 hours of finding out about it.
Impact For Users
Disqus said that it has seen no unauthorized logins in relation to this leaked database. This may be because no plain text passwords were leaked. However, the company noted that there’s still a risk that the hackers may try to decrypt some of the passwords. Therefore, Disqus reset everyone’s passwords to make the old passwords obsolete and worthless to the attackers. The company also recommended all Disqus users change their passwords on other services where they may have reused their Disqus passwords.
Although the passwords were hashed, email addresses were in plain-text, which means users may receive unwanted email in the future.
Disqus doesn’t believe the database is widely distributed right now. The most recent exposed data was from July, 2012.
Addressing The Problem
Beyond resetting everyone’s passwords, Disqus has also started notifying all 17.5 million users that were impacted by the data breach, so they can take further precautions on their own. The company also mentioned that the reason why the leaked data contains only user information from 2012 may be because that’s when it added some security upgrades to its servers. This included changing the hashing algorithm from SHA1 to bcrypt, which is currently one of the best industry standards for encrypting user passwords.
Disqus said that it will continue to investigate the issue and will share anything it finds in future announcements.
