Freepik , a website that provides access to high-quality photos and graphics, has revealed a major breach data.
The company officially announced this after some users started complaining on social media about receiving breach notifications in their inboxes.
The company officially disclosed the data breach yesterday, confirming the authenticity of emails that registered users in recent days.
Hackers used SQL to gain access to Freepik's system
According to the company's official statement, the breach occurred when hackers used a SQL injection vulnerability to gain access to one of the databases that stored user data.
Freepik said that the attackers obtained usernames and passwords of millions of users (older ones), registered on the Freepik and Flaticon.
Freepik did not say when the data breach occurred or when it discovered it. However, the company says it notified authorities as soon as it learned of the incident and began investigating the case.
Millions of passwords have been stolen
Freepik said that not all users had passwords associated with their accounts and the hackers only got the emails of some.
The company estimates that these users numbered 4.5 million and used Google, Facebook or Twitter to log in to accounts .
“For the remaining 3.77 million users, the attackers obtained the email address and a hash of the password,” the company added. “For 3.55 million of these users, the hash method is bcrypt and for the rest , MD5. We have since upgraded all users’ hashes to bcrypt.”
User notification process
Freepik said it is now in the process of notifying all affected users. The company is sending emails to Freepik and Flaticon users, depending on which service they were subscribed to. Below are some of the messages users received.
“Hashed passwords with salted MD5 were invalidated and users received emails to choose a new password and to change the password if they used it on any other site,” Freepik said. “Users who had their passwords hashed with bcrypt received an email suggesting they change their password. Users whose email was only compromised were notified, but no specific action was required from them.”
Freepik is one of the most popular sites today (ranked 97 in Alexa's top 100 sites list). Flaticon is ranked 668th.
When EQT acquired Freepik in late May of this year, the company claimed that the Freepik service had over 20 million registered users.
Users registered on Slidesgo, another Freepik site, do not appear to have been affected.
