Security News Disqus Confirms 2012 Data Breach That Exposed Details for 17.5 Million Users

[frogboy]

Earlier today, on a late Friday evening, Disqus confirmed a data breach that appears to have taken place in the summer of 2012, and during which an unknown attacker(s) made off with details for at least 17.5 million user accounts.

The company found out about the breach from Aussie security researcher Troy Hunt, who come into the possession of a copy of the stolen data and informed Disqus yesterday afternoon.

According to one of Hunt's tweets, it took Disqus 23 hours and 42 minutes to investigate the data and confirm the breach.

Hack took place in July 2012
Disqus, the web's larger provider of hosted commenting systems, has already started notifying users included in the data provided by Hunt.

According to the company, hackers stole email addresses, Disqus usernames, sign-up dates, and last login dates in plain text. SHA-1 hashed passwords were only included for about a third of the 17.5 million details.

Disqus says the last entry in the exposed data is from July 2012, a good indicator of when the security breach took place.

Full Article. Disqus Confirms 2012 Data Breach That Exposed Details for 17.5 Million Users

 

[Danielx64]

Well the only way I found out about this was via an email from Have I been pwned - and this is the second data breach that I been caught up in as many days.

 

[brambedkar59]

What about those users who uses fb login in Disqus?

 

[Local Host]

This is bothersome, this is the only way so far I've been exploited (third-parties with my accounts getting hacked), thankfully I use KeePass with long passwords and special characters.

I'm going to change my Disqus password regardless if I get notification or not

 

[Danielx64]

I'm going to change my Disqus password regardless if I get notification or not

Really everyone should be forced to change their passwords regardless if they were affected or not.

 

[frogboy]

I changed my password straight away.

 

[codswollip]

I'm going to change my Disqus password regardless if I get notification or not

I routinely change my whole account... dropping one for another.

 

[Danielx64]

I routinely change my whole account... dropping one for another.

Are you even allowed to have more than one account?