Security alert [12/19/2016]: Ethereum.org Forums Database Compromised

On December 16, we had been made conscious that somebody had not too long ago gained unauthorized entry to a database from forum.ethereum.org. We instantly launched an intensive investigation to find out the origin, nature, and scope of this incident. Here’s what we all know:

• The knowledge that was not too long ago accessed is a database backup from April 2016 and contained details about 16.5k discussion board customers.
• The leaked data consists of
  
  • Messages, each private and non-private
  • IP-addresses
  • Username and electronic mail addresses
  • Profile data
  • Hashed passwords
    
    • ~13k bcrypt hashes (salted)
    • ~1.5k WordPress-hashes (salted)
    • ~2k accounts with out passwords (used federated login)

• The attacker self-disclosed that they’re the identical individual/individuals who recently hacked Bo Shen.
• The attacker used social engineering to realize entry to a cell phone quantity that allowed them to realize entry to different accounts, considered one of which had entry to an outdated database backup from the discussion board.

We’re taking the next steps:

• Discussion board customers whose data might have been compromised by the leak might be receiving an electronic mail with further data.
• Now we have closed the unauthorized entry factors concerned within the leak.
• We’re imposing stricter safety tips internally comparable to eradicating the restoration cellphone numbers from accounts and utilizing encryption for delicate information.
• We’re offering the e-mail addresses that we imagine had been leaked to https://haveibeenpwned.com, a service that helps talk with affected customers.
• We’re resetting all discussion board passwords, efficient instantly.

In case you had been affected by the assault we suggest you do the next:

• Be sure that your passwords should not reused between providers. When you have reused your discussion board.ethereum.org password elsewhere, change it in these locations.

Moreover, we suggest this excellent blog post by Kraken that gives helpful details about how you can defend towards some of these assaults.

We deeply remorse that this incident occurred and are working diligently internally, in addition to with exterior companions to deal with the incident.

Questions will be directed to security@ethereum.org.