A Drupal data breach was announced by the official Drupal Association, that Passwords for almost one million accounts on the Drupal.org website are being reset after hackers gained unauthorized access to sensitive user data.
The security of the open source content management system has been compromised via third-party software installed on the Drupal.org server infrastructure, and was not the result of a vulnerability within Drupal itself. As countermeasure it is resetting the passwords for nearly one million accounts in the wake of a data breach.
Information exposed includes usernames, email addresses, and country information, as well as hashed passwords. The Drupal.org hasn't revealed the name of the third-party application exploited during the attack.
Evidence of the Drupal data breach was found during a routine security audit:
"Upon discovering the files during a security audit, we shut down the association.drupal.org website to mitigate any possible ongoing security issues related to the files," "The Drupal security team then began forensic evaluations and discovered that user account information had been accessed via this vulnerability."
"The Drupal.org Security Team and Infrastructure Team have discovered unauthorized access to account information on Drupal.org and groups.drupal.org.
This access was accomplished via third-party software installed on the Drupal.org server infrastructure, and was not the result of a vulnerability within Drupal itself. This notice applies specifically to user account data stored on Drupal.org and groups.drupal.org, and not to sites running Drupal generally."
The Drupal data breach is considerably really serious about user's security, an impressive amount of web sites is based on the popular content management. The thousands of websites that run on Drupal software estimated at 2 percent of all sites should not be affected by the data breach.
The Drupal.org Security Team confirmed the "unauthorized access" to their system, highlighting that there's no evidence that any information was actually stolen. As a precautionary measure was requested all users to reset their passwords at their next login attempt.
Holly Ross, Executive Director for Drupal Association confirmed that they are investigating on the incident that could have exposed also other info: "We are still investigating the incident and may learn about other types of information compromised, in which case we will notify you accordingly"
The attacks to Open Source CMS solutions are not an isolated cases due their large diffusion, in the past Joomla and WordPress platforms were hit and used to spread malicious code, WordPress recently was hit by a massive "brute-force" attack by botnet composed by almost 100,000 bots.
It's easy to predict that this kind of attacks is likely to increase for the large-diffusion of these platforms which makes them privileged targets.
Drupal.org account holders will be required to change their password by entering their username or e-mail address, and following the link included in the e-mail message that follows.
