Data Breaches at Timehop, Macys Highlight Need for Multi-Factor Authentication

Names, email addresses, and some phone numbers belonging to 21 million people exposed in Timehop intrusion; Macys incident impacts small number of customers.

Two new data breaches revealed this week — one at Timehop and the other at Macys — have once again focused attention on the continuing failure by many enterprises to implement strong authentication for controlling access to critical accounts.
Timehop, a service that helps users of Facebook and other social media platforms share nostalgic moments from old posts, on Sunday said someone using an access credential to its cloud account had illegally accessed names and email addresses belonging to some 21 million users. Phone numbers belonging to about 22%, or 4.7 million of them, were also compromised in the network intrusion the company said.
Timehop
blamed
the breach on its failure to use strong authentication to protect the cloud administrator account that was beached.
Meanwhile, the intrusion at Macys appears to have resulted from a similar authentication weakness. In an emailed statement, the company described the incident as impacting a small number of customers who shopped online at macys.com and bloomingdales.com. Macys said it had implemented additional security measures and contacted all impacted customers but offered no other details about the incident.
However,
MediaPost
, the first to report on the breach, said Macys had blamed an unnamed third-party for accessing the data from an external location using valid login credentials.
The two breaches are similar to many in recent years involving the use of legitimate credentials to access and steal enterprise data. Often, the threat actors behind the attacks have first stolen the credentials or obtained them via social engineering, and then used them to access the target network.
A May 2018
report
by cloud security vendor RedLock found that 27% of organizations in fact have experienced potential account compromises. Over the last year alone, several major enterprises including Uber, Tesla, Gemalto, and Aviva have experienced incidents where access credentials have been leaked or stolen, RedLock noted. Security experts have said that such breaches heighten the need for organizations to use strong authentication for controlling access to critical assets.
Multi-factor authentication solutions have been around for over a decade. Yet many critical systems remain unprotected, says Dana Tamir, vice president of market strategy at Silverfort. Many organizations have continued to drag their heels on implementing the measure for a variety of reasons.
Tokens Taken, Too
According to Timehop, in addition to the data on 21 million users, the attackers also managed to steal the unique tokens provided by social media companies to Timehop so it can read other peoples old social media posts. The tokens would have allowed the attacker to view the social media posts of the impacted users, without their permission. However, there is no evidence that the attacker actually used the tokens to illegally access user accounts or any of their data.
Timehop discovered the intrusion while it was in progress and managed to lock out the attackers slightly more than two hours later. Since then the company has implemented multifactor authentication to secure authorization and access controls across all of its internal accounts. Timehop has also deactivated all the compromised access tokens so they can no longer be misused.
As a result of these changes, users will have to log in and re-authenticate to Timehops service for each social media account, the company said.
Strong MFA can prevent account takeovers, such as the ones seen in the Macys and TimeHop breaches, says Will LaSala, security evangelist at OneSpan.
Just about every IT administrator already knows this, but often there are factors at play that make it hard for organizations to deploy MFA easily, he says. When breaches like these occur, it is easy to point out that the IT professional missed the obvious security concern. But it is less easy to see why those concerns were overlooked in the first place, LaSala says.
One challenge is that most multi-factor authentication products require organizations to deploy software on both the server and user endpoints, says Tamir. Modern IT infrastructures are also becoming increasingly dynamic, and new servers are often spun up and down in these environments in just a few minutes.
This makes it difficult to ensure authentication software is installed and configured for each server, she notes. Requiring software on various user endpoint platforms similarly is problematic due to BYOD trends and the dynamic nature of mobile device use.
Sometimes, organizations might have to implement MFA products from multiple vendors due to the nature of their technology infrastructure — increasing costs and complexity in the process. And in some environments, as with critical servers on industrial OT networks and SCADA environments or certain financial systems, it isnt possible to deploy any MFA software at all, she says.
Related Content:
Why Facebook Security Questions Are no Substitute for MFA
New Voice MFA Tool Uses Machine Learning
PCI DSS 3.2: Making the Move to MFA
4 Steps to Achieve MFA Everywhere

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the
conference
and
to register.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Data Breaches at Timehop, Macys Highlight Need for Multi-Factor Authentication