Data leak
LivingSocial Hack β 50 Million Customer Accounts
Primary Source βIncident Details
In late April 2013, LivingSocial (an online deals and local offers marketplace, then majority-owned by Amazon) suffered a cyberattack in which hackers accessed a database containing information for up to 50 million customers in the United States and other countries. LivingSocial disclosed the breach on April 26, 2013, and immediately expired all customer passwords, requiring users to create new ones. Exposed data included names, email addresses, dates of birth, and encrypted (hashed and salted) passwords. Financial data and payment card information were reportedly stored in a separate system and were not accessed. Countries outside the U.S. including Philippines, Indonesia, Thailand, and Malaysia were also affected. LivingSocial notified affected users by email and advised them to change passwords on any other sites where they used the same credentials. At 50 million records, the breach was one of the larger consumer data incidents up to that point in 2013. LivingSocial later declined as a business and was acquired and restructured multiple times; the breach did not directly cause its business difficulties but added to a difficult period for the company.
Technical Details
- Initial Attack Vector
- Unauthorized access to LivingSocial's database systems; the specific technical vector was not disclosed publicly, but the attacker gained read access to a customer database
Timeline
- 2013-04-01 Breach occurred
- 2013-04-26 Publicly disclosed
- 2013-04-26 Customers notified