Q&A repository Quora is the latest hack victim with 100 million records 'stolen'

Chris Merriman
@ChrisTheDJ
04 December 2018

Tweet
Facebook
Send to

EVERYBODY RUN around and freak out! Quora has been hacked! AAAAAAAAAAAGH!

We know what you're probably thinking. What the fudge is Quora and why should I care?

Quora is a Q&A community which is legendary for long, random but often very helpful answers to short, ignorant and often stupid questions. Registration is required, but through linking your account to your existing Google or Facebook credentials, before adding a password.

It's a fairly big hack - 100,000 users - so not Marriott Hotels big, but enough to make you wonder if any of us is truly safe anywhere (cue more running around and freaking).

Stolen data is pretty benign compared to a lot of hacks, but still there's names, e-mail addresses, activity on the site, including some that you may have elected to keep private and passwords, fortunately ‘salted and hashed', though Quora is advising you change any shared passwords just in case.

The issue was first discovered on Friday, and the company is still looking in to exactly what happened, giving all the usual reassurances that security is a top priority. Quora also says in has spotted the root of the problem and will take steps.

All users have been logged out of their accounts and will be invited to create a new password when they log back in.

In an act of mea culpa, Adam D'Angelo, Quora's co-founder and CEO said:

"It is our responsibility to make sure things like this don't happen, and we failed to meet that responsibility. We recognize that in order to maintain user trust, we need to work very hard to make sure this does not happen again.

"There's little hope of sharing and growing the world's knowledge if those doing so cannot feel safe and secure, and cannot trust that their information will remain private. We are continuing to work very hard to remedy the situation, and we hope over time to prove that we are worthy of your trust."

As ever though, the lessons are for the end users - use 2FA when available, never use the same password on multiple sites and for goodness sakes, however much you trust a website, don't assume that it's secure. μ