If you’ve never heard of ClixSense, you’re not alone. It’s a website that supposedly pays its users for viewing advertisements and completing surveys online. Unfortunately, people who signed up to use the system got a whole lot more than they bargained for.
In this case, the particulars of the hack are as interesting as its consequences. The hackers were able to gain access by taking control of an old, unused server that was still tied to the company’s network. From there, they were able to gain virtually unfettered access, making off with 6.6 million user names, passwords, addresses, social security numbers, birthdays, IP addresses and other personal information, along with the source code for the company’s website and more than 70,000 company emails, among other things.
Additionally, they set most, if not all user account balances to zero. In other words, the hack was about as complete as it could possibly get.
The company has, of course, recommended to its users that they reset their passwords immediately, but there has been no word on if or when user account balances will be restored as the company struggles to deal with the aftermath of the incident.
There are a number of valuable lessons to be learned from this most recent mega-breach. First, if you have an older, un- or seldom-used server still attached to your network, it’s probably your weakest link. Take it offline, or be sure that all relevant updates are flowing to it, and that traffic to it is being properly monitored.
Second, take steps to encrypt your data. In the case of ClixSense, the hackers were able to get all the information in the form of a simple text file. Presumably, it was kept in this format because the company assumed that it was safe, behind their defenses.
Third, and most importantly from a user perspective, this highlights how important it is to use a different password on every website you visit. If you are a ClixSense user, and you use the same password there that you use to access your bank account, congratulations! You just gave the hackers access to your bank account too. Whatever else you do, change your password immediately if you’re a ClixSense user.
