Data leak
LivingSocial Breach β 50 Million User Accounts
Primary Source βIncident Details
On 26 April 2013, LivingSocial β a daily deals website owned by Amazon β disclosed that attackers had accessed its database containing up to 50 million customer records. Exposed data included names, email addresses, dates of birth, and hashed passwords (SHA1 with salt). LivingSocial forced a password reset for all affected customers on the same day as disclosure β a rapid response for the era. Financial data was stored in separate systems and was not compromised. LivingSocial disclosed the breach the same day it was discovered, emailing customers directly. The breach occurred during LivingSocial’s period of rapid growth following Amazon’s 2011 investment (Amazon owned approximately 30% of LivingSocial). The SHA1 password hashing used, while better than many contemporaneous services, was considered inadequate security practice even in 2013. The breach was one of several major breach disclosures in 2013 (alongside Adobe with 153M records, Target, Evernote, and others) that highlighted the scale of credential theft targeting consumer internet services.
Technical Details
- Initial Attack Vector
- Unknown attacker gained unauthorized access to LivingSocial's customer database; specific technical attack vector was not disclosed; attacker accessed and exfiltrated up to 50 million customer records
- Vendor / Product
- LivingSocial customer database (Amazon subsidiary)
Timeline
- 2013-04-26 Breach occurred
- 2013-04-26 Publicly disclosed
- 2013-04-26 Customers notified