Gawker Media Hacked

The company's user database and content management system have been breached, prompting calls to change passwords.

Thomas Claburn, Editor at Large, Enterprise Mobility

December 13, 2010

2 Min Read
Dark Reading logo in a gray background | Dark Reading

Gawker Media on Sunday said that its user database had been hacked and encouraged all registered users of the company's Web sites to change their passwords.

Gawker Media's properties include Gawker, Gizmodo, Jalopnik, Jezebel, Kotaku, Lifehacker, Deadspin, io9, and Fleshbot.

Over 1.3 million accounts, with some 540,000 associated e-mail addresses, were exposed and the company's content management system is said to have been compromised as well. The hacked data base file, initially available on The Pirate Bay's Web site, has since been removed. Gawker says that although the passwords were encrypted, they're still potentially vulnerable to hackers.

A group identifying itself as Gnosis has claimed responsibility for the attack. The group says its motivation is to punish Gawker for being arrogant, according to Mediaite.

Someone -- apparently H.D. Moore, creator of the metasploit framework and CSO at Rapid7, whose e-mail address is listed -- has posted a CSV file of the domains of affected e-mail addresses and hashed e-mail address values as a Google Fusion Table. The file includes instructions for how to generate an MD5 hash of one's e-mail address and to search for that value among the posted list of compromised accounts. Finding one's e-mail address on this list means it's definitely time to change your password.

Gawker is also advising users who maintained linked Twitter accounts with the same password to change their passwords at Twitter.

There's currently a Twitter spam campaign that's promoting acai berries through compromised accounts and there's some speculation that Twitter accounts exposed through the Gawker database compromise are being exploited to deliver the tweet spam.

Gawker Media issued an apology for the security failure. "We're deeply embarrassed by this breach," the company said in a statement on its Web site. "We should not be in the position of relying on the goodwill of the hackers who identified the weakness in our systems. And, yes, the irony is not lost on us."

About the Author

Thomas Claburn

Editor at Large, Enterprise Mobility

Thomas Claburn has been writing about business and technology since 1996, for publications such as New Architect, PC Computing, InformationWeek, Salon, Wired, and Ziff Davis Smart Business. Before that, he worked in film and television, having earned a not particularly useful master's degree in film production. He wrote the original treatment for 3DO's Killing Time, a short story that appeared in On Spec, and the screenplay for an independent film called The Hanged Man, which he would later direct. He's the author of a science fiction novel, Reflecting Fires, and a sadly neglected blog, Lot 49. His iPhone game, Blocfall, is available through the iTunes App Store. His wife is a talented jazz singer; he does not sing, which is for the best.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights