From Digibase Knowledge Base
Revision as of 17:48, 30 May 2016 by Kradorex Xeron (talk | contribs) (Created page with "{{DBSAHEAD | TITLE=Tumblr Compromise | KEYWORDS=Tumblr, compromise, passwords, email addresses }} '''DBSA ID:''' {{PAGENAME}} '''Regarding:''' Tumblr Compromise '''Writeup:...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

Disclaimer: as technology changes, advisories may become out of date or may no longer be relevant, please refer to the "Date" section of the header to be sure the advisory is recent as pertains to your situation.

Digibase Security Advisory - Tumblr Compromise

Keywords: Tumblr, compromise, passwords, email addresses

DBSA ID: 2016-05301

Regarding: Tumblr Compromise

Writeup: Kradorex Xeron (talk) 17:48, 30 May 2016 (EDT)

Date: 2016 05 30

Last Modified: 20160530174829 by Kradorex Xeron

Who should take note: All Tumblr Users


Priority: MODERATE

Rationale: Users need to ensure their information is secured.

Severity: HIGH

Rationale: Usernames, insecurely hashed passwords, email addresses among other information has reportedly been compromised


Rationale: 65 Million records are reported to have been compromised


Tumblr is a social networking site targetted toward sharing various kinds of content between users. On 30 May 2016, it has been reported that in 2013 that there was a compromise of Tumblr's systems resulting in 65 million email addresses and passwords being compromised.


Users should change their Tumblr passwords on a rolling basis to temporary passwords, once immediately and then again at 1 weeks. After 2 weeks users may reset to a more longterm password. Users should also ensure that their password is not shared among other sites, to which those passwords will also need to be reset.

Users should also be highly suspicious of any contacts via email and use non-email methods to verify legitimacy of such email. Password resets should only be performed through known good links.