News-reading app Flipboard has issued a password reset after discovering that hackers broke into and possibly obtained copies of some of its databases containing user account credentials and other information.
In its Thursday announcement, Flipboard said the hackers had access to its systems for more than nine months – first from June 2, 2018 to March 23, 2019, then again from April 21 to 22, 2019. The breached databases contained some users' actual names, usernames, cryptographically protected passwords, email addresses, and the digital tokens that link social media accounts to Flipboard accounts.
"Flipboard has always cryptographically protected passwords using a technique known by security experts as 'salted hashing,'" the company wrote. "The benefit of hashing passwords is that we never need to store the passwords in plain text. Moreover, using a unique salt for each password in combination with the hashing algorithms makes it very difficult and requires significant computer resources to crack these passwords."
Flipboard said the "vast majority" of passwords were hashed with a utility called bcrypt, which provides advanced protection against password cracking. If you haven't logged into your Flipboard account since March 14, 2012, however, your password was uniquely salted and hashed with the older SHA-1 algorithm.
Either way, the next time you go to log into Flipboard, you'll need to update your account password. If you use your old Flipboard password for any other online services, you should change it there as well.
In addition to issuing the password reset, Flipboard has replaced or deleted all digital tokens. The company said it hasn't found any evidence that the hackers have accessed the third-party accounts connected to users' Flipboard accounts. If you did connect your Flipboard to a third-party service, such as social media, you may need to reconnect it.
Flipboard has notified law enforcement about the intrusion and "implemented enhanced security measures" to prevent future data breaches. The company said its engineering team identified the latest intrusion on April 23 while investigating suspicious activity that occurred a month earlier.
"We deeply regret this incident happened," Flipboard wrote. For more information, head here.