VerticalScope data breach

[joby_toss]

http://www.verticalscope.com/about-us/n ... reach.html

http://securityaffairs.co/wordpress/484 ... reach.html

https://www.leakedsource.com/blog/verticalscope

In February Verticalscope.com and all of their domains were hacked, stolen data fueled the criminal underground.

What Happened?
On June 13, 2016, we became aware that February 2016 data stolen from VerticalScope was being made available online.
What Information Was Involved?
Community member usernames, email addresses, hashed passwords, community userIDS, community website, and the IP address the username originally registered with.

This data set contains nearly 45 million records from over 1100 websites and communities. Some of the larger domains include Techsupportforum.com MobileCampsites.com Pbnation.com and Motorcycle.com. Each record may contain an email address, a username, an IP address, one password and in some cases a second password. We added this data set to LeakedSource on April 27th 2016 but only analyzed it now.
Given the massive scale of this breach, it is also likely that VerticalScope stored all of their data on interconnected or even the same servers as there is no other way to explain a theft on such a large scale. ZDNET reporter Zack Whittaker contacted VerticalScope on our behalf and they confirmed the breach in addition to our verification from April.

I am member of only one platform hosted by VS, but I don't understand why it took so long for them to find out and for me to be informed?! Luckily, I was using a unique password for that account, as we should always do...

P.S. after further analyses of this issue, I conclude that VS is never to be trusted as they have no idea what security and communication really mean! The amount and magnitude of mistakes they made and are still making is baffling!

[webfork]

Although it sounds like there were many problems, it often only takes one break in a chain. Like a lot of security problems it comes from both organizational issues and simple lack of training. I have been very close to projects that were desperate to get a product out to customers because they either had very little internal budget/support or had some kind of internal deadline before they get terminated. Additionally, a close friend was recently on a call where they said "[Microsoft's webserver] IIS doesn't need to be hardened, it's secure by design."

I'd like to think it comes down to the fact that the industry is just going to have to accept slower release timelines and more difficult audit procedures, but I really don't know.