Details of over one million Forbes readers leaked online (including mine)

Graham Cluley

ForbesOver one million readers of the Forbes website might be wise to change their password, and keep an eye open for suspicious emails, after a group of notorious hackers gained access to user information and published it online.

The Syrian Electronic Army hacked Forbes a few days ago, defacing its website and hijacking some Twitter accounts.

But now they have taken things a step further, posting details of 1,071,963 users they stole from the Forbes servers – including their usernames, email addresses and encrypted versions of passwords they use to access the website.

The file starts by listing details of Forbes staffers who were, understandably, the site’s earliest users.

Sign up to our newsletter
Security news, advice, and tips.

However, it quickly becomes members of the public – including, I discovered, an entry for myself.

So now online criminals have access to over a million email addresses and usernames of Forbes readers – information that could be exploited in phishing attacks and spam campaigns designed to hoodwink unsuspecting internet users.

Forbes hasn’t contacted me to advise me to change my password as a precaution (fortunately I don’t use the same password anywhere else, so even if it was cracked it wouldn’t be of much use to anyone), and I can find no advisory on their website warning users of the potential risks.

However, as Softpedia reports, the company has published a warning on its official Facebook page:

Security message: was targeted in a digital attack and our publishing platform was compromised. Users’ email addresses may have been exposed. The passwords were encrypted, but as a precaution, we strongly encourage Forbes readers and contributors to change their passwords on our system, and encourage them to change them on other websites if they use the same password elsewhere. We have notified law enforcement. We take this matter very seriously and apologize to the members of our community for this breach.

It’s sensible advice from Forbes, and hopefully Forbes will make more efforts to spread the message to affected users.

After all, it was the magazine’s sloppy practices in the first place which allowed the Syrian Electronic Army to break into their systems and cause this mess.

Found this article interesting? Follow Graham Cluley on Twitter to read more of the exclusive content we post.

Graham Cluley is a veteran of the anti-virus industry having worked for a number of security companies since the early 1990s when he wrote the first ever version of Dr Solomon's Anti-Virus Toolkit for Windows. Now an independent security analyst, he regularly makes media appearances and is an international public speaker on the topic of computer security, hackers, and online privacy. Follow him on Twitter at @gcluley, or drop him an email.

One comment on “Details of over one million Forbes readers leaked online (including mine)”

  1. I did receive an email from Forbes, with the very helpful suggestion to change passwords on other systems, where the password is the same (which, like you, is not the case for me) in case my Forbes password was cracked.

What do you think? Leave a comment

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.