The Syrian Electronic Army hacked Forbes a few days ago, defacing its website and hijacking some Twitter accounts.
But now they have taken things a step further, posting details of 1,071,963 users they stole from the Forbes servers – including their usernames, email addresses and encrypted versions of passwords they use to access the website.
The file starts by listing details of Forbes staffers who were, understandably, the site’s earliest users.
However, it quickly becomes members of the public – including, I discovered, an entry for myself.
So now online criminals have access to over a million email addresses and usernames of Forbes readers – information that could be exploited in phishing attacks and spam campaigns designed to hoodwink unsuspecting internet users.
Forbes hasn’t contacted me to advise me to change my password as a precaution (fortunately I don’t use the same password anywhere else, so even if it was cracked it wouldn’t be of much use to anyone), and I can find no advisory on their website warning users of the potential risks.
Security message: Forbes.com was targeted in a digital attack and our publishing platform was compromised. Users’ email addresses may have been exposed. The passwords were encrypted, but as a precaution, we strongly encourage Forbes readers and contributors to change their passwords on our system, and encourage them to change them on other websites if they use the same password elsewhere. We have notified law enforcement. We take this matter very seriously and apologize to the members of our community for this breach.
It’s sensible advice from Forbes, and hopefully Forbes will make more efforts to spread the message to affected users.
After all, it was the magazine’s sloppy practices in the first place which allowed the Syrian Electronic Army to break into their systems and cause this mess.
Found this article interesting? Follow Graham Cluley on Twitter to read more of the exclusive content we post.