A Raleigh, NC-based online analytics company ended up hacked and its users’ details, including passwords, leaked online.
The company, Social Blade, provides data on YouTube and Twitch video channels and Instagram accounts in an effort to help users increase their online presence.
Attackers were able to get into Social Blade’s website and forum and leaked the details of 13,009 forum users and 273,086 website users, said researchers at LeadkedSource in a post.
The compromised information includes email addresses, usernames, user IDs, password hashes and IP addresses. The hackers also obtained YouTube, Instagram and Twitter authentication tokens for thousands of users, along with analytics data.
The forum passwords ended up stored as MD5 hashes with a unique salt for each user, while the website passwords stored using a custom implementation of SHA512, but without a unique salt, LeakedSource reseachers said. This makes it easy for an attacker to crack most passwords.
An analysis conducted by LeakedSource showed the most common passwords found in the leak are “123456,” “123456789,” “socialblade” and “password.”
Social Blade confirmed that its website suffered a security breach.
The company said attackers obtained a partial database dump that included IPs, email addresses and hashed passwords by exploiting a vulnerability in the forum software.
“Upon learning about the incident, we immediately patched the security issue by making the conscious decision to remove our forum entirely,” the company said in an advisory.
The company reset all user passwords as a result of the incident.