<story><title>Weebly hacked, 43M credentials stolen</title><url>https://techcrunch.com/2016/10/20/weebly-hacked-43-million-credentials-stolen/</url></story><parent_chain></parent_chain><comment><author>drusenko</author><text>Obviously, this is a very disappointing situation for us -- we&amp;#x27;ve always taken security very seriously since day 1, it&amp;#x27;s something that&amp;#x27;s been core to who we are from the beginning.&lt;p&gt;That said, how you respond in this situation can be just as important, and so we are making sure to be incredibly proactive in addressing the situation &amp;amp; transparent in how we communicate the details with our customers. Our top and immediate concern has been our users and the safety of their accounts.&lt;p&gt;A few days ago we became aware that an unauthorized party obtained email addresses&amp;#x2F;usernames, last login IP addresses and bcrypt hashed passwords for a large number of customers (anyone who signed up prior to March 1 of this year).&lt;p&gt;At this point we do not have evidence of any customer website&amp;#x2F;account being improperly accessed. It&amp;#x27;s also worth noting that we do not store any full credit card numbers on Weebly servers, so any credit card information was not part of this incident.&lt;p&gt;We immediately starting working on taking steps to notify our customers, and were able to get this out in a matter of a few days. We&amp;#x27;re initiating password resets as of this morning, and we&amp;#x27;ve also made several improvements to the application including new password complexity requirements and a new dashboard that gives customers an overview of recent log-in history of their Weebly account to track account activity. We also increased our bcrypt work factor from 8 to 10, and all passwords will be automatically upgraded as of the next time a user logs in.&lt;p&gt;We&amp;#x27;ve hired an incident response firm who is working with our internal team to complete a full investigation. In the meantime, we&amp;#x27;re examining our stack top to bottom and taking many steps to enhance our network and application security. This is an area we take very seriously and we&amp;#x27;ll be putting in tremendous effort to ensure this doesn&amp;#x27;t happen again.</text></comment>
<story><title>Weebly hacked, 43M credentials stolen</title><url>https://techcrunch.com/2016/10/20/weebly-hacked-43-million-credentials-stolen/</url></story><parent_chain></parent_chain><comment><author>papayawhip</author><text>Responsible disclosure and proper handling of passwords as well as not storing credit cards. Barring no breach at all, this is about as well as something like this can go.</text></comment>