Reverb site compromised. Change your password.
Posted: Mon Apr 26, 2021 3:31 pm
Since many of us have reverb.com accounts...
The date of the compromise isn't mentioned, and the Reverb site has no mention of the compromise, but many folks with Reverb accounts are getting e-mailed notices of a site compromise. I've looked at the e-mail header and it definitely comes from Reverb. Time to change your password to be safe.
This stuff happens. Sometimes people are lax. Sometimes the bad guys just outpace the security folks who are working just as hard at keeping things locked up. "...publicly accessible for a short period of time" makes me think that directory permissions changed and exposed info was stored where it shouldn't be. Here's the basics from the e-mail:
Dear Reverber,
We take our users’ privacy and security very seriously. Out of an abundance of caution, we wanted to inform you that Reverb recently became aware of an issue relating to user contact information.
At this time, we believe that contact information, including name, address, phone number, and email, was publicly accessible for a short period of time. We do not have reason to believe that any of this information has been misused, nor do we believe that password or payment information were involved.
As soon as we learned of this issue, we immediately worked to resolve it. We conducted an investigation of the situation to determine what happened and are taking steps to prevent something like this from happening again.
As a general reminder, we recommend that you change your Reverb password on a regular basis. If you’d like to update your password you can do so easily from your Account Settings page.
The date of the compromise isn't mentioned, and the Reverb site has no mention of the compromise, but many folks with Reverb accounts are getting e-mailed notices of a site compromise. I've looked at the e-mail header and it definitely comes from Reverb. Time to change your password to be safe.
This stuff happens. Sometimes people are lax. Sometimes the bad guys just outpace the security folks who are working just as hard at keeping things locked up. "...publicly accessible for a short period of time" makes me think that directory permissions changed and exposed info was stored where it shouldn't be. Here's the basics from the e-mail:
Dear Reverber,
We take our users’ privacy and security very seriously. Out of an abundance of caution, we wanted to inform you that Reverb recently became aware of an issue relating to user contact information.
At this time, we believe that contact information, including name, address, phone number, and email, was publicly accessible for a short period of time. We do not have reason to believe that any of this information has been misused, nor do we believe that password or payment information were involved.
As soon as we learned of this issue, we immediately worked to resolve it. We conducted an investigation of the situation to determine what happened and are taking steps to prevent something like this from happening again.
As a general reminder, we recommend that you change your Reverb password on a regular basis. If you’d like to update your password you can do so easily from your Account Settings page.