Snapchat plans to put out a more secure version of its application following a breach that allowed hackers to collect the usernames and phone numbers of around 4.6 million of its devotees.
The disappearing-message service popular with young people said in a blog post that the updated version of its app would allow users to opt out of its Find Friends feature, which was apparently at the heart of the breach, and would stem future attempts to abuse its service.
The breach occurred after security experts warned the company at least twice about a vulnerability in its system.
Before announcing its plans to update the app, Snapchat had been quiet. Its seemingly detached response caused some security specialists to wonder whether the young company can handle the spotlight into which it has been thrust over the last year as its service has become enormously popular.
In response to a warning by Gibson Security on Christmas Day – which followed an earlier alert in August – Snapchat said in a blog post that it had implemented “various safeguards” over the past year that would make it more difficult to steal large sets of phone numbers.
As Americans rang in the new year, hackers reportedly published 4.6 million Snapchat usernames and phone numbers on a website called snapchatdb.info, which has since been suspended. The breach came less than a week after the most recent warning from security experts that an attack could take place.
The incident bruises the company’s image and may threaten its rapid growth.
Gibson Security has created a site – http://lookup.gibsonsec.org/ – that lets users type in their username to see if their phone number was among those leaked.
Gibson says users can delete their Snapchat account if they wish, but “this won’t remove your phone number from the already circulating leaked database”. Users can also ask their phone company to give them a new phone number.
“Lastly, ensure that your security settings are up to scratch on your social media profiles. Be careful about what data you give away to sites when you sign up – if you don’t think a service requires your phone number, don’t give it to them,” Gibson said.
The Snapchat breach comes just two weeks after Target was hit with a massive data security breach that affected as many as 40 million debit and credit card holders.
Gartner security analyst Avivah Litan said phone numbers were not considered “sensitive” personally identifiable information – such as credit card or social security numbers – so they are collected by all sorts of companies to verify a person’s identity.
A phone number is “not as bad as password or magnetic strip information, but it’s the piece of the puzzle that criminals need to impersonate identities”, she said.