SitePoint, a site that provides access to web development tutorials and books, revealed that it suffered a data breach last week, sending emails to its users. The company officially admitted to the breach after a hacker put up for sale a collection of one million SitePoint user details on a hacking forum in December 2020.
Specifically, SitePoint stated the following in its related notification: "We believe that the information that was breached primarily relates to your name, email address, hashed password, username, and IP address."
SitePoint has already initiated a password on all accounts and is asking users to choose new passwords that are at least ten characters long. Additionally, the company estimates that the stolen passwords are currently secure, as they have been hashed with the bcrypt algorithm, which should make cracking the password strings into plaintext versions a fairly lengthy process for now. It also recommends that site users change their passwords on any other sites they use the same password as SitePoint, as a precaution.
SitePoint said that based on current evidence, the data breach occurred when attackers gained access to a third-party tool used to monitor its GitHub. This allowed them to gain access through the codebase to systems . That tool has since been removed, all of the company's API keys have been rotated, and passwords have been changed, the company noted.
While SitePoint doesn't mention this tool by name, it's likely referring to a tool from Git analysis service Waydev, which uncovered a security breach last summer.
As ZDNet reports, the same tool was also used to breach Teespring, whose data was sold by the same hacker, in the same package, at the same time as the SitePoint data.
