The Ethereum Foundation has issued a security alert on their official blog today, December 19, 2016. A hacker was allowed unauthorized entry to a database on the Foundation's forum at forum.ethereum.org. Through social engineering, the attacker was able to gain access to a mobile phone number that leads to other accounts, one of which connected to an old database backup of the forum from April 2016.
The information of over 16,000 forum users was compromised. Usernames, email addresses, IP-addresses, passwords, and other information has been leaked. This is a problem because anyone who uses the same password for multiple other sites could have those accounts broken into, following this breach.
The Ethereum Foundation is already taking action by closing the unauthorized access points that were hacked into and resetting all forum passwords. They’re also emailing more information to all forum users whose information may have been exposed as well as adding the leaked emails to https://haveibeenpwned.com to help make sure affected users are notified.
If you think you’ve been affected by this attack (most likely if you were active on the Ethereum forum this past April), then the Ethereum Foundation recommends you audit your own security. If you reuse the same password for multiple sites, it’s highly recommended that you change that password. They also shared a comprehensive blog post created by Kraken, meticulously detailing how to protect against these types of attacks.
What’s interesting is that this hacker identified his or herself as the same person (or group) who recently hacked Bo Shen, a notable blockchain investor. Bo Shen had $300,000 worth of Augur’s REP tokens stolen from him, along with an unspecified amount of Ether.
If you believe your information may have been compromised, you should check out the official post on the Foundation’s blog here.