Timehop has shared additional details about the recent data breach that impacted roughly 21 million user accounts, including what the attackers did once they gained access to the company’s systems and what other type of information was compromised.
Timehop provides an application that shows users the photos, videos and posts they shared on the current day in previous years on Facebook, Instagram, Twitter and other websites.
Earlier this month, the company revealed that one or more malicious hackers gained unauthorized access to a database storing usernames, phone numbers, email addresses, and social media access tokens for all users, which could have been leveraged to access a user’s posts on social networking websites.
In response to the incident, Timehop invalidated social media tokens to prevent abuse and instructed users to re-authenticate each service.
In an update posted on Wednesday, Timehop revealed that dates of birth, genders, and country codes were also compromised in the incident.
The investigation is ongoing, but so far the company believes the attacker gained access to 20.4 million names, 15.5 million dates of birth, 18.6 million email addresses, 9.2 million gender designations, and 4.9 million phone numbers. Timehop listed separately the number of impacted PII records covered by the recently introduced GDPR.
According to Timehop, the attacker first accessed its systems on December 19, 2017, after stealing an employee’s credentials for the company’s cloud computing environment. The unauthorized access came from an IP address in the Netherlands.
The hacker immediately started conducting reconnaissance, including scraping the list of roles and accounts, but the compromised environment had not stored any personal information.
Personal information was copied by Timehop to the compromised database in early April and the attacker only discovered it on June 22. On July 4, the hacker made a copy of the user database and then changed its password. These actions led to service disruptions and internal alerts being triggered, but it took nearly 24 hours for Timehop to determine that it had been breached after the first alert.
“[Timehop engineers] did not immediately suspect a security incident for two reasons that in retrospect are learning moments,” Timehop said. “First, because it was a holiday and no engineers were in the office, he considered it likely that another engineer had been doing maintenance and changed the password. Second, password anomalies of a similar nature had been observed in past outage. He made the decision that the event would be examined the next day, when engineers returned to the office.”