data from the American technology site Mashable has been leaked online.
On Sunday, November 8, Mashable issued a statement saying that a cybercriminal had managed to obtain a copy of one of its databases . The hacker published the database online then .
The company behind the site learned of the attack on November 4th and immediately launched an investigation. It also temporarily disabled access to all accounts affected by the breach as a precautionary measure.
According to the company, the exposed data is linked to a sign-in feature that is no longer used on the Mashable site. data includes: user first and last name, gender, dates of birth, location data, email addresses, date of registration on the site, IP addresses, links to users' social media profiles, and OAuth tokens.
"On Wednesday afternoon, November 4th, we learned that a hackerknown for targeting sites and apps had posted a copy of a Mashable site database online," Mashable said.
According to Mashable, the investigation showed that the database was related to a sign-in feature that had previously allowed readers to use social media accounts (like Facebook or Twitter) to log in. This feature made it easier for users to share content from Mashable.
Mashable stated that it does not store financial data of its registered users, so such data is not at risk.
Also, the site has not found any evidence to prove that data related to user passwords has been leaked online.
The Mashable site asked users to be wary of potential phishing emails that may contain links to unknown and malicious sites. In addition, users were asked to confirm the authenticity of emails they receive by other means (e.g., by phone).
"We appreciate your attention to this important matter and apologize for any concern or inconvenience this incident may cause," Mashable said.
“Protecting our users' data is one of our highest priorities. We are working hard to investigate the attack and prevent a similar incident from happening again.“.
According to InfoSecurity Magazine, Mashable did not reveal the identity of the attacker, although it said it was a well-known hacker who routinely targets sites and applications.
