After breach, Stack Overflow says some user data exposed

After disclosing a breach earlier this week, Stack Overflow has confirmed some user data was accessed.

In case you missed it, the developer knowledge sharing site confirmed Thursday a breach of its systems last weekend, resulting in unauthorized access to production systems — the front-facing servers that actively powers the site. The company gave few details, except that customer data was unaffected by the breach.

Now the company said the intrusion on the website began about a week earlier and “a very small number” of users had some data exposed.

“The intrusion originated on May 5 when a build deployed to the development tier for stackoverflow.com contained a bug, which allowed an attacker to log in to our development tier as well as escalate their access on the production version of stackoverflow.com,” said Mary Ferguson, vice president of engineering.

“This change was quickly identified and we revoked their access network-wide, began investigating the intrusion, and began taking steps to remediate the intrusion,” she said.

Although the user database wasn’t compromised, “we have identified privileged web requests that the attacker made that could have returned IP address, names, or emails” for some users.

The company didn’t immediately quantify how many users were affected — we’ve asked for clarification — but affected users will be notified, said Ferguson.

Stack Overflow’s teams, business and enterprise customers are on separate, unaffected infrastructure, said Ferguson, and there’s “no evidence” that those systems were accessed. The company’s advertising and talent business is said to be unaffected.

In response to the incident, the company terminated the unauthorized access and is conducting an “extensive” audit of its logs to gauge the level of access gained by the attacker.

Read more:

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s