According to a report by Dan Goodin, a security researcher at Ars Technica, passwords and other personal data from 1.4 million Gatehub accounts and 800,000 EpicBot accounts have been leaked online. The leaks were discovered by Troy Hunt, a security researcher who runs the service Have I Been Pwned.
The leaked data relates to both websites which were encrypted with bcrypt, which according to Goodin is one of the most secure.
The data was posted on a popular hacking in August. The person who posted it said it included two-factor authentication keys, wallet , and even hashing data.
However, after an investigation, GateHub officials stated that there was no evidence of hashing, which seemingly means that while personal data was leaked, no private keys were exposed.
There is, however, at least one user who was notified by a separate service that his GateHub data had been compromised.
The user data leaked by EpicBot, on the other hand, includes usernames and IP addresses.
According to an official statement from GateHub in July, the wallet service had been aware of the incident three months before announcing it.
However, GateHub estimates that the hackers only gained access to 18,473 encrypted customer accounts – “a very small percentage of our total database .” The statement also said that the “leaked information” included “email addresses, passwords, encrypted XRP wallet secret keys, first names (if any), and last names (if any).” Not all information for every account was leaked.
The service also indicates that users whose accounts were compromised were notified, sensitive information was re-encrypted, and new encryption keys were generated.
However, Goodin pointed out that “the statement does not explain why the investigation was unable to verify the authenticity of the data 25 days after it was announced and four months after its initial discovery. It is also unclear what exactly the officials mean by re- encryption.”
