Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

Home Design Website Houzz Alerts Users of Data Breach

Home remodeling and design platform Houzz informed customers this week of a data breach that involved some personal information.

Home remodeling and design platform Houzz informed customers this week of a data breach that involved some personal information.

According to its website, Houzz has over 40 million monthly unique users, but the company said not everyone was impacted by the incident. It’s unclear exactly how many individuals are affected, but Houzz says it has notified them.

The company discovered the breach in December, when it learned that a file containing user data was obtained by an “unauthorized third party.” Regarding how the hack was discovered, Houzz said, “Our security team has a number of ways to learn about potential security vulnerabilities, including our own active methods and third-party reporting.”

The compromised file stored profile information such as name, city, state, country and description. Houzz noted that some users may have made this information public.

The file also contained some internal identifiers used by Houzz systems, but the company believes this data does not hold any value to outsiders. The most sensitive information includes usernames, password hashes, IP addresses, and, if access to Houzz was made through Facebook, the user’s Facebook ID.

Houzz has told users that social security numbers or financial information have not been involved in the incident.

While the company claims that it does not believe passwords were actually compromised — it has not shared any information on the hashing algorithm, but says a unique salt is used for each password — it has still advised customers to reset their password on both the Houzz platform and any other site where the same password was set.

Houzz says it has notified law enforcement and called in a forensics firm to assist with the investigation and remediation efforts.

Advertisement. Scroll to continue reading.

Related: Typeform Data Breach Hits Many Organizations

Related: OSIsoft Warns Employees, Contractors of Data Breach

Related: Facebook Says 50M User Accounts Affected by Security Breach

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Gain valuable insights from industry professionals who will help guide you through the intricacies of industrial cybersecurity.

Register

Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.

Register

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Cybercrime

The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Data Protection

The cryptopocalypse is the point at which quantum computing becomes powerful enough to use Shor’s algorithm to crack PKI encryption.

Cybercrime

As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Cybercrime

Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.

Artificial Intelligence

The CRYSTALS-Kyber public-key encryption and key encapsulation mechanism recommended by NIST for post-quantum cryptography has been broken using AI combined with side channel attacks.