Timehop, an app that highlights old posts from the present day of past years, has announced a security breach that affected all 21 million users of the platform, but not all to the same extent. The company said a hacker gained access to its server database and stole user information, including usernames, emails, phone numbers, and access keys.
Timehop announced that not all users had filled out the above information, as only 22% of users (nearly 3.7 million users) had registered a phone number. In addition, many of the registered names were fake.
However, the hacker had access to all the access keys, through which Timehop had access to all of the users' social media accounts.
The company said it de-authenticated all social media accounts of all users so that the hacker could not access any of them. The social media accounts included Facebook, Facebook Messenger, Twitter and Instagram. Investigations are still underway by authorities and cyber security firms to identify the hacker.
According to information from the investigation, the breach began in December 2017, when the hacker gained access to the administrator's account. The account did not have any 2-factor authentication enabled.
After the hacker first accessed the admin account, there were 3 more connections (total 4). The breach was not noticed until July 4th, when the fourth connection occurred and the hacker began downloading the database. The company noticed the traffic and terminated the process after 2 hours and 19 minutes.
At present, all accounts appear to be safe.
