Story image

Quora's been breached: Users, change your passwords

05 Dec 2018

Quora’s 100 million users are the latest targets in a major data breach, but at least the company has moved quickly to contain it.

Quora, a social website that allows users to ask and answer questions from others, sent out an announcement yesterday that notified users about the breach.

“On Friday [November 30] we discovered that some user data was compromised by a third party who gained unauthorised access to our systems,” the company says.

That third party may have accessed account and username information, including names, emails, IP addresses, user IDs, encrypted passwords, user account settings, and personalisation data.

Not every Quora users was affected, and some users have been affected more than others, Quora says. 

While user passwords were encrypted, Quora strongly recommends that people who use the same password across many different sites should change that password.

Users’ public questions, answers, blog posts, comments, drafts, and upvotes may also have been accessed. Anonymous users haven’t been affected by the breach because Quora doesn’t store their identities.

But the damage doesn’t stop there – the third party may have accessed data from linked networks, such as contacts, interests, demographic interests, as well as access tokens that have now been rendered useless.

Cybersecurity firm Thycotic’s chief security scientist Joseph Carson says the linked networks are particularly concerning.

“Common organisations have used social logins to create news accounts and in doing so the customers allow access to their social media accounts which sometimes includes friend contacts, check-in information and more detailed contact information beyond what you would normally include when creating accounts,” Carson says.

“Another day of password resets will continue to cause cyber fatigue and it’s very likely that the passwords exposed here are the same passwords people are using for their corporate email account or even their bank account. Password reuse is the biggest risk that people take today.”

While some people may wonder if the stolen information may be used in identity theft, Quora says it’s highly unlikely because it doesn’t collect ‘sensitive personal information’ like credit cards and government IDs.

However, you don’t necessarily need financial information to conduct identity theft – names, emails and locations can be enough.

Quora says it has already put in place security measures while the investigation into the breach continues.

It is currently working with law enforcement and a digital forensics firm to help with the investigation.

“We’re in the process of notifying users whose data has been compromised.

"Out of an abundance of caution, we are logging out all Quora users who may have been affected, and, if they use a password as their authentication method, we are invalidating their passwords.

"We believe we’ve identified the root cause and taken steps to address the issue, although our investigation is ongoing and we’ll continue to make security improvements.”

Quora recognises its responsibility to keep users safe and admits it failed. 

“We recognise that in order to maintain user trust, we need to work very hard to make sure this does not happen again,” the company says.

“There’s little hope of sharing and growing the world’s knowledge if those doing so cannot feel safe and secure, and cannot trust that their information will remain private. We are continuing to work very hard to remedy the situation, and we hope over time to prove that we are worthy of your trust.”

Apple mania! A brief look at Apple TV+, Apple Arcade, and Apple News+
Whether you’re after news, TV, or gaming, it seems like Apple is pulling out all the stops to get your attention.
Giveaway: Win the Huawei Y6 2019 with FutureFive
We’re back with the first giveaway of 2019, and once again Huawei is dishing out the goodies with a Huawei Y6 2019 smartphone up for grabs!
Meet the future of women in IT
Emily Sopers has just won Kordia’s first ever Women in Technology Scholarship, which was established to address gender imbalance in the information and communications technology (ICT) sector.
Vector penalised $3.5 million for excessive levels of power outages
''Given the impact electricity outages have on consumers and businesses it is crucial that lines companies have systems in place to identify and manage the risks present in their networks."
Game review: Tom Clancy’s The Division 2
Ubisoft has listened to all of the fan feedback and I can proudly say that Tom Clancy’s The Division 2 is a much better experience over the first game.
'Iwi Algorithm' can grow Aotearoa's mana
Ngāti Whātua Ōrākei innovation officer Te Aroha Grace says AI can help to combine the values from different cultures to help grow Aotearoa’s mana and brand – and AI is not just for commercial gain.
Why 'right to repair' legislation could be a new lease on life for broken devices
“These companies are profiting at the expense of our environment and our pocketbooks as we become a throw-away society that discards over 6 million tonnes of electronics every year.”
Hands-on review: Huawei Watch GT
I’ve thoroughly enjoyed my time with the Watch GT. It’s converted me from being anti-smartwatch to someone who’s genuinely considering buying one.