In the second week of November, 123RF.com, a famous Stock Photo site became the target of a data heist. 123RF site is famous for selling royalty-free images, videos, and audio content that can be used on different websites. They also sell printed content and the site usually sees very heavy traffic, with more than 26 million visitors every month.
Now, the owner of 123RF.com, Inmagine Group has recently shared how the incident happened. Some hackers got access to one of the servers in 123RF’s data center, and they then proceeded to copy the membership data. They stole a database containing 8.3 million user records and then they started selling those records on other hacker forums!
As per BleepingComputer’s reports, they have seen a sample of the database that got stolen, and the data that may have leaked includes the full name of the members, email address, MD5 hashed passwords, Company name, address, phone number, PayPal email, and their IP address. Thankfully, there were no financial details amongst all this personal data.
BleepingComputer used some de-hashing tools and was able to crack the encrypted MD5 hashed passwords of most of these accounts. This means that anyone else can also use the same tools to get through these passwords.
Now, the problem here is that if someone gets access to more information after cracking through an account’s password, or if the account holder uses the same password for other accounts on other sites also, then all of their accounts are at a risk. So, Inmagine Group has advised the victim members to immediately change all their passwords on other accounts also if they are the same as the ones, they used for 123RF.com.
Needless to say, the Inmagine Group is deeply apologetic and remorseful about this incident. According to them, their site security protocols are regularly upgraded and are pretty strict. They have already involved law enforcement agencies to look into this matter, and they will try to make their site more tightly secure from now on.
They have also shared that the database that got stolen is not current, and its last update was made in October 2019. So, there are chances that most of the users whose records have been breached are all outdated. But anyway, this does not undermine the severity of the situation.
The unfortunate incident has already happened, so there is no use to cry over spilled milk. But Inmagine Group has requested their users to start using more secure passwords, or better use a password manager to create unique passwords for every site.
Now, the owner of 123RF.com, Inmagine Group has recently shared how the incident happened. Some hackers got access to one of the servers in 123RF’s data center, and they then proceeded to copy the membership data. They stole a database containing 8.3 million user records and then they started selling those records on other hacker forums!
As per BleepingComputer’s reports, they have seen a sample of the database that got stolen, and the data that may have leaked includes the full name of the members, email address, MD5 hashed passwords, Company name, address, phone number, PayPal email, and their IP address. Thankfully, there were no financial details amongst all this personal data.
BleepingComputer used some de-hashing tools and was able to crack the encrypted MD5 hashed passwords of most of these accounts. This means that anyone else can also use the same tools to get through these passwords.
Now, the problem here is that if someone gets access to more information after cracking through an account’s password, or if the account holder uses the same password for other accounts on other sites also, then all of their accounts are at a risk. So, Inmagine Group has advised the victim members to immediately change all their passwords on other accounts also if they are the same as the ones, they used for 123RF.com.
Needless to say, the Inmagine Group is deeply apologetic and remorseful about this incident. According to them, their site security protocols are regularly upgraded and are pretty strict. They have already involved law enforcement agencies to look into this matter, and they will try to make their site more tightly secure from now on.
They have also shared that the database that got stolen is not current, and its last update was made in October 2019. So, there are chances that most of the users whose records have been breached are all outdated. But anyway, this does not undermine the severity of the situation.
The unfortunate incident has already happened, so there is no use to cry over spilled milk. But Inmagine Group has requested their users to start using more secure passwords, or better use a password manager to create unique passwords for every site.
