This past weekend, the Timehop app announced a large network intrusion that affected over 21 million users. The app compiles information from all forms of social media and creates a “look back in time” for the user. The data that was breached included names, email addresses, and phone numbers. Luckily, no private messages, financial data, or social media were affected.
According to Timehop, “The breach occurred because an access credential to our cloud computing environment was compromised. That cloud computing account had not been protected by multifactor authentication. We have now taken steps that include multifactor authentication to secure our authorization and access controls on all accounts”. Timehop has taken several actions to mitigate and control this incident as well as prevent future escalation of this breach and of future breaches. These actions include:
Deploying enhanced security protocols to secure systems
Timehop immediately implemented a “user audit and permissions inventory; changed all passwords and keys; added multifactor authentication to all accounts in all cloud-based services; revoked inappropriate permissions; increased alarming and monitoring; and performed various other technical tasks related to authentication and access management and more pervasive encryption throughout our environment.” These enhanced system security measures are necessary for all businesses to engage. It is important to enact your cyber security plan in a timely manner if a breach is to occur and create a strategic method for implementation.
Sending all necessary notifications to all parties
In addition to engaging in security protocols for securing systems, it is also vital to inform all parties involved. Timehop notified all third parties including all involved technology providers as well as local and federal enforcement officials. All users were sent a security announcement via the app. Users were logged out by default and asked to authenticate their credentials to ensure that their data was not affected any further. A statement was also sent out on social media and available through the app. All parties were involved in taking the necessary actions to mitigate the incident and prevent miscommunication such as rumors that could’ve escalated the issue.
Engaging in a cyber-threat intelligence firm
To guarantee the best results, it is always best to bring in the experts. Timehop relied on a company that specializes in cyber security. The company conducted a vulnerability scan to determine changes in the network as well as new breach points identified in the cyber landscape. They were then able to exploit the vulnerabilities to better understand how to better protect their network. They are now ensuring on-going monitoring of the dark web. All of which were necessary measures to mitigate the attack create a safer cyber space for their users.
While we can all hope a cyber-breach never affects our organizations, hope is not a strategy. Don’t wait until a cyber-attack reaches you (like Timehop did) and forces a defensive response. Start being proactive today and take the corrective measures to keep your company’s data safe. For information on how a comprehensive security program can help protect your business, click here.
To read the full statement from Timehop, click here.