Disqus disqus.com Disqus data breach: what happened and what to do
In October 2017 Disqus announced a breach dating back to July 2012. About 17.5 million email addresses and usernames were exposed, with salted SHA1 password hashes for users who signed up with a login of their own.
View all 13,115 breaches- Breach date
- Jul 2012
- Affected
- 17,551,044
- Data exposed
- Email addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In October 2017, the blog commenting service Disqus announced it had suffered a data breach. The breach dated back to July 2012 but was not identified until the data finally surfaced years later. Have I Been Pwned (HIBP) lists 17,551,044 accounts.
Security coverage reported that Disqus received the data on 5 October, confirmed it was a snapshot of its 2012 user database and began notifying users within about a day. Some of the records dated back to 2007. Disqus said it was not aware of any unauthorised logins resulting from the incident.
What was exposed
HIBP lists email addresses, passwords and usernames. Users who created a Disqus login had salted SHA1 password hashes. Users who signed in with a social account only had references to those accounts, with no password. Press reports also mentioned sign-up and last login dates.
SHA1 is a weaker hashing method than modern ones, so simple passwords can be recovered from it. Your email address and username also let scammers connect your comments on public sites with your identity, which makes phishing more believable.
The company's response
Disqus forced a password reset for users whose passwords were in the exposed data, and said it was possible but unlikely that the hashes had been cracked. If you changed your Disqus password after October 2017 and never reused the old one, the risk is small.
What to do if you were in it
- 1
Change your Disqus password and any reuse of it
If you still have a Disqus account, set a new password. Then change it on every other account that shares the old one or a close variation. A password manager makes unique passwords painless.
- 2
Turn on two-factor login
Use an authenticator app on your email, banking and shopping accounts. A leaked password then isn't enough to get in.
- 3
Expect phishing that mentions the breach
Scammers use leaked email addresses to send fake security alerts. Don't click links in unexpected messages. Go to the site yourself instead.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches include your details. Serus monitors breach databases and the dark web and alerts you, but it can't remove data from a breach.
Frequently asked
Was I affected by the Disqus breach?
If you had a Disqus account in 2012 or earlier, your email address and username may be in the data. Look up your email on Have I Been Pwned or run a free Serus scan.
What was exposed in the Disqus breach?
HIBP lists email addresses, usernames and passwords. Passwords were salted SHA1 hashes, and social login users only had references to those accounts.
Did Disqus reset passwords?
Yes. Disqus said it forced a password reset for users whose passwords were in the exposed data.
Should I change my password?
Yes, if you used your old Disqus password anywhere else. Change it there and use a unique password per site.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
