Crowdfunding Site Patreon Data Stolen to the Tune of 2.3 Million Users

You may have heard that crowdfunding website Patreon’s network was breached and has affected at least 2.3 million people.  Information stolen included user names, email addresses, and other information. It is unknown precisely what “other” information was included. The Patreon website reports that social security numbers, tax information, and credit card numbers were not included because they were not stored on Patreon’s servers.

However, passwords were part of the intrusion. The company says they were encrypted with one of the strongest methods of encryption, Bcrypt, and that they would be hard to crack. However, the same was true for AshleyMadison (owned by Avid Life Media) and the hackers managed to crack those and post user information about its members. This resulted in embarrassment for many of them in a best case scenario.

In the Patreon case, security researcher Troy Hunt found the 2.3 million email addresses, along with passwords and donation records as part of a nearly 15 GB data dump that was posted online. The data he found was as recent as from September 24. Unlike with Ashley Madison, the motive for posting the information about Patreon’s users online is unclear.

Patreon is recommending that all users of the website change their passwords right away. When doing so, make sure they include all the elements of a strong password or passphrase. These include:

• At least eight characters

• At least one special character, such as any of those above the number keys on a keyboard. More than one is recommended

• At least one of each upper and lower case letters

• At least one number. More is better

Also, avoid using personal information in your passwords and don’t reuse password and user name combinations across websites. Each website, particularly those that include any sensitive data, should be unique. Hackers will make attempts to use login credentials on multiple websites and they are successful a surprising number of times.

Even if you only used the site once to make a donation or otherwise, it’s best to change your password in case it was the same you used elsewhere.

Since social security numbers and credit card details were stolen, watch statements for potential fraudulent charges. Also, take advantage of the free annual credit report from each of the three credit bureaus. Stagger when you order those and get one every four months to keep a better eye on potential issues. Report anything that is incorrect to the agency right away so it can be remedied quicker.

Additional information may turn up as part of this breach because the hackers also stole the source code to the website. Patreon is still trying to determine how that happened as well as how the hackers got into the network in the first place. The access has been cut off and the company is taking measures to ensure something like this does not happen again.