Mozilla, Firefox maker has admitted its developer exposed personal details of 76,000 users of its Developer Network, along with thousands of encrypted passwords.
Joe Stevensen, operations security manager and Stormy Peters, developer relations director, in a new blog post, admitted that a Mozilla developer discovered the incident around two weeks ago.
“Starting on about June 23, for a period of 30 days, a data sanitization process of the Mozilla Developer Network (MDN) site database had been failing, resulting in the accidental disclosure of MDN email addresses of about 76,000 users and encrypted passwords of about 4,000 users on a publicly accessible server,” they explained.
“As soon as we learned of it, the database dump file was removed from the server immediately, and the process that generates the dump was disabled to prevent further disclosure. While we have not been able to detect malicious activity on that server, we cannot be sure there wasn’t any such access.”
The encrypted passwords were salted hashes and they can’t be used on their own in the event that attackers have got hold of them to log-in to the site, Mozilla said.
However, MDN users re-using their passwords on other sites were warned to change these credentials immediately.
“We’ve sent notices to the users who were affected. For those that had both email and encrypted passwords disclosed, we recommended that they change any similar passwords they may be using,” Peters and Stevensen added.
This isn’t the first time Mozilla has accidentally exposed user data.
Back in 2010 a third party contacted it to warn that the developer had posted sensitive information about users of its addons.mozilla.org site to a public web server.
The database in question apparently contained user email addresses, first and last names, and MD5 password hashes relating to 44,000 inactive accounts.