15th of February, 2014 - Kickstarter hacked. Change your password now

pete_c

Guru
I just received this notification in my Inbox.

If you have a Kickstarter account or campaign, you need to read and heed the following message:

Kickstarter, for those of you who don't know, is a crowdfunding site for projects of all kinds including movies, books, art, and new products.

As soon as you login to Kickstarter, you're prompted to change your password due to a security breach.

"On Wednesday night, law enforcement officials contacted Kickstarter and alerted us that hackers had sought and gained unauthorized access to some of our customers' data. Upon learning this, we immediately closed the security breach and began strengthening security measures throughout the Kickstarter system."

No credit card data of any kind was accessed by hackers. There is no evidence of unauthorized activity of any kind on your account.

While no credit card data was accessed, some information about our customers was. Accessed information included usernames, email addresses, mailing addresses, phone numbers, and encrypted passwords. Actual passwords were not revealed, however it is possible for a malicious person with enough computing power to guess and crack an encrypted password, particularly a weak or obvious one.

As a precaution, we strongly recommend that you change the password of your Kickstarter account, and other accounts where you use this password.

To change your password, log in to your account at Kickstarter.com and look for the banner at the top of the page to create a new, secure password. We recommend you do the same on other sites where you use this password. For additional help with password security, we recommend tools like 1Password and LastPass.

We’re incredibly sorry that this happened.

We set a very high bar for how we serve our community, and this incident is frustrating and upsetting. We have since improved our security procedures and systems in numerous ways, and we will continue to do so in the weeks and months to come. We are working closely with law enforcement, and we are doing everything in our power to prevent this from happening again.

Kickstarter is a vibrant community like no other, and we can’t thank you enough for being a part of it. Please let us know if you have any questions, comments, or concerns. You can reach us at [email protected].

Thank you,
Yancey Strickler
Kickstarter CEO


This post has been promoted to an article
 
Thanks Pete, I meant to actually post this yesterday, then got busy with family stuff.
 
I am starting to sour on crowdfunding, though my experience is limited.
 
Both projects that I funded with KickStarter have had 'perpetual' delays (Ube and Pressy projects).  Seems like my money could have been spent in better ways.  Then this! :(
 
Yup; here its only been one Kickstarter funding thing to date.
 
It was the Almond + Kickstarter and the stuff on the forum here which convinced me.
 
I did see similar thoughts to yours relating to "crowdfunding" on some other posts yesterday.
 
I received the same notice as well.  Disappointing, but this is why you use a strong and unique password on every site (and even a difficult to guess e-mail address at this point).
 
If you use the same password everywhere else, I highly recommend you start using an offline password manager such as KeePass or 1Password.
 
Speaking of password managers - any reason Last Pass isn't a good choice? Ive been looking.
 
LastPass has a lot of nice features, but the one that killed it for me is that it syncs your passwords through the cloud so you can access your passwords from anywhere.  I will *never* let my password repository be uploaded to the cloud.  Yeah, I know, it's encrypted.  But I've worked with the NSA types and know a lot about what they are capable of.
 
I like PasswordSafe.  It's free, and open source.
 
Tried changing mine and it wouldn't let me. Kept getting an error. This morning I received an email stating I had won something from Kickstarter and they just needed some info for me to complete it. I took it as a phishing attempt and deleted it. I need to contact Kickstarter to find out why I cant get the password changed or else will have to delete my account.
 
Back
Top