The popular Q&A website Quora announced that its platform was breached by hackers on November 30th. About 100 million users’ data were compromised "as a result of unauthorized access to one of our systems by a malicious third party."
Here, Quora is investigating the cause of the issue, and in addition to the work by its internal security teams, the company is also getting help from digital forensics and security firms. Quora has also notified the law enforcement about the case.
The hackers who breached Quora, are believed to have accessed the following information:
- Account information, e.g. name, email address, encrypted (hashed) password, data imported from linked networks when authorized by users.
- Public content and actions, e.g. questions, answers, comments, upvotes.
- Non-public content and actions, e.g. answer requests, downvotes, direct messages (note that a low percentage of Quora users have sent or received such messages).
The company is also notifying impacted users via email, and will provide relevant updates as they are available.
"Out of an abundance of caution, we are logging out all Quora users who may have been affected, and, if they use a password as their authentication method, we are invalidating their passwords," explained Quora.
The attack may not cause much direct monetary damage to users, as Quora doesn’t store credit card details or other payment-related information.
Personal information that aren't affected, also include questions and answers that were written anonymously. These are not affected by the breach as Quora doesn't store the identities of people who post anonymous content. However, since the majority of the contents accessed by the hackers were already public on the platform, the compromise of accounts and other private information can be serious.
Quora said that users' passwords are encrypted (hashed with a salt that varies for each user). But still, it's generally a best practice for users to never reuse the same password across multiple services, and "we recommend that people change their passwords if they are doing so," continued Quora.
In the blog post, Quora also apologized to its users, saying that it is "very sorry for any concern or inconvenience this may cause."
"We recognize that in order to maintain user trust, we need to work very hard to make sure this does not happen again. There’s little hope of sharing and growing the world’s knowledge if those doing so cannot feel safe and secure, and cannot trust that their information will remain private."
"We are continuing to work very hard to remedy the situation, and we hope over time to prove that we are worthy of your trust."
