Social media analytics platform Social Blade has confirmed it suffered a data breach after its database was hacked and listed for sale on a hacking forum.

Social Blade is an analytics platform that provides statistical graphs for YouTube, Twitter, Twitch, Daily Motion, Mixer, and Instagram accounts, allowing customers to see estimated earnings and projects.

The company offers an API allowing customers to integrate Social Blade data directly into their own platforms.

After BleepingComputer contacted Social Blade about the sale of their data, the company confirmed that it had suffered a breach and began sending out data breach notifications to customers.

“On December 14, we were made aware of a potential data breach whereby an individual had acquired exports of our user database and was attempting to sell it on a hacker forum,” a notification read. data breach sent to customers.

“Samples have been released and we have verified that they are real. It appears that this individual used a vulnerability on our website to gain access to our database.”

This data breach notification tells customers that a hacker has managed to gain access to the company’s database and steal the following information:

• Email addresses
• Password hashes
• Customer IDs
• Tokens for business API users
• Authentication tokens for connected accounts
• Various non-personal and internal data

The notice clarifies that no credit card information was exposed as a result of this security incident.

Although Social Blade states that user passwords have been hashed using the bcrypt algorithm and cannot be easily decrypted, the company still suggests that all users reset their passwords. However, there will be no platform-wide credential reset.

Authorization tokens for business users and logged in social media accounts have also been cycled, preventing threat actors from continuing to use those listed in the stolen database.

BleepingComputer contacted Social Blade to inquire if these stolen authorization tokens had been abused by threat actors, but a response was not immediately available.

Social Blade for sale on a hacker forum

BleepingComputer first became aware of the data breach when a malicious actor began selling the company’s data on Monday, December 12.

In a post on the Breached hacking forum, a threat actor claimed that the data was stolen in September 2022 and was ready to sell it to a maximum of one to two people.

The hacker claimed that the stolen database contained 5.6 million records and shared samples of exfiltrated data including IP addresses, emails, database structure, etc.

BleepingComputer reached out to Social Blade at the time to ask for a comment on the validity of the samples and got confirmation that the data appeared authentic.

The company says it has now closed the security hole the intruder exploited to gain access to its systems and is now performing additional checks to ensure all systems are hardened enough to prevent similar incidents in the future. .

“We are all too aware that bad actors will continue to attempt to infiltrate IT infrastructure worldwide, and rest assured that Social Blade will never be complacent in bolstering our security and defenses,” the notice reads. .

Social Blade urges users to remain vigilant against phishing attempts that typically accompany large-scale data breaches, impersonating the breached company to steal passwords and credit card numbers.