App developer emerges as Apple leak source The chief executive of a small app developer in Florida has admitted that his database appears to be the source of 1m Apple device identifiers leaked by the hacktivist group Anonymous last week. Paul DeHart, chief executive of Blue Toad, told NBC News that his team, after being contacted by an independent security researcher, found a "98 per cent correlation" between its customer data and the unique device identifiers (UDIDs) published online by AntiSec, an offshoot of the Anonymous hacking collective. The news emerged as a widespread outage at web hosting company GoDaddy rendered thousands of personal and small business websites inaccessible. One individual, claiming to be a member of Anonymous, claimed responsibility for the purported attack, although others who speak for the hacktivist group distanced themselves from the incident, which GoDaddy has not yet explained. The Blue Toad chief's claim undermines Anonymous' allegations last week that it had obtained the data from an FBI agent's laptop computer. The FBI had denied any involvement or monitoring of UDIDs, while Apple had also said that it did not pass device data to the agency. Mr DeHart told NBC that he had "100 per cent confidence level it's our data" and had contacted law enforcement. "We're pretty apologetic to the people who relied on us to keep this information secure," he said, adding that the detail of Anonymous' version of events "doesn't make sense." Blue Toad provides app-building services to thousands of publishers and claims that its products have millions of users. Mr DeHart put a statement on Blue Toad's corporate blog, saying that the company had been the victim of a "determined criminal attack" and had since moved away from using UDIDs. A little more than a week ago, Blue Toad was the victim of a criminal cyberattack, which resulted in the theft of Apple UDIDs from our systems. Shortly thereafter, an unknown group posted these UDIDs on the internet," he wrote. We have fixed the vulnerability and are working around the clock to ensure that a security breach doesn't happen again. An Apple spokesperson said that the company "will soon be banning the use of UDID," as part of an update to its developer tools in iOS6, the company's new mobile operating system "As an app developer, BlueToad would have access to a user's device information such as UDID, device name and type," Apple said. "Developers do not have access to users" account information, passwords or credit card information, unless a user specifically elects to provide that information to the developer." However, the security researcher who initially contacted Blue Toad said that despite finding the developer's name several times among the leaked data, uncertainties remained over the real source. "I'm still not completely clear on all the technical details," wrote David Schuetz of Intrepidus Group, a mobile security firm. Was Blue Toad really the source of the breach? How did the data get to the FBI (if it really did at all)? Or is it possible this is just a secondary breach, not even related to the UDID leak and it was just a coincidence that I noticed? Every Apple iPhone, iPad and iPod has a permanent UDID, which can be associated with their owner's app account, physical location, phone number, home address and social networking profiles. Though Apple is not directly responsible for the leak of its customers' data, the Anonymous attack came at an awkward time for the company, which is expected to unveil its latest iPhone at an event in San Francisco on Wednesday. While attacks on Apple remain relatively rare, GoDaddy is a more familiar target for the ire of internet campaigners and hacktivists such as Anonymous. The US-based hosting provider voiced support for the proposed Stop Online Piracy Act, or SOPA, which groups including Wikipedia, Facebook and Google all opposed. GoDaddy's political positioning resulted in a boycott in December by thousands of its customers, according to some estimates. Yet Monday's downtime across the GoDaddy hosting network, which lasted for several hours in the middle of the American day, has not clearly been established to be the result of hacktivist attacks. GoDaddy did not respond to a request for further information, saying only on its Twitter feed that its engineers were "continuing our work to get back on track," as many customers vented their anger at the service provider.