Independent security researcher Troy Hunt revealed yesterday that he received a data dump containing 65,469,298 emails and hashed passwords, which the anonymous donor told him belonged to Tumblr users.
The researcher spotted the data dump on The Real Deal Dark Web marketplace, where a hacker named Peace (also known as Peace_of_mind) is selling it for 0.4255 Bitcoin ($225).
The researcher says that the passwords included in the data dump appear to be both hashed and salted, meaning they are much more secure compared to the state in which passwords are stored on websites like LinkedIn and MySpace, also recent victims of massive data breaches. In both cases, the data was hashed only via SHA1, and the LeakedSource team was able to crack most of the leaked passwords.
Tumblr has not issued an official statement about the incident yet, but Yahoo spoke out on May 12 about a possible data breach.
At the time, the Tumblr team had revealed that they received a tip about a potential data breach dating back to 2013, before Yahoo acquired the Tumblr platform.
The Tumblr team did not disclose the number of users affected, but they said they had begun a password reset process for users they believe were affected.
Tumblr's latest user statistics revealed that the platform has around 550 million users, which means that over an eighth of the site.
Troy Hunt is the man behind the online service Have I've Been Pwned, where users can search a giant database of publicly available data breaches. Hunt said he added Tumblr's data to the database, and users can now search and see if their data was exposed.
Peace, the hacker selling the data, is the same person who put up for sale the data dumps of MySpace and LinkedIn, as well as other online services, such as Fling.com and the Linux Mint forum.
