By: Ravie Lakshmanan
Popular short-form social video service TikTok denied reports that it was breached by a hacking group, after it claimed to have gained access to an insecure cloud server.
“TikTok prioritizes the privacy and security of our users’ data,” the ByteDance-owned company told The Hacker News. “Our security team investigated these claims and found no evidence of a security breach.”
The denial follows alleged reports of a hack that surfaced on the Breach Forums message board on September 3, with the threat actor noting that the server holds 2.05 billion records in a humongous 790GB database.
“Who would have thought that TikTok would decide to store all their internal backend source code on one Alibaba Cloud instance using a trashy password?,” the hacking group known as BlueHornet (aka AgainstTheWest) tweeted over the weekend.
Bob Diachenko, threat intelligence researcher at Security Discovery, said the breach is “real” and that the data is likely to have originated from “Hangzhou Julun Network Technology Co., Ltd rather than TikTok.”
That said, it’s far from clear at the moment where exactly the data has come from and whether third-parties have access to this kind of information.
“This is so far pretty inconclusive; some data matches production info, albeit publicly accessible info,” security researcher Troy Hunt said in a tweet. “Some data is junk, but it could be non-production or test data. It’s a bit of a mixed bag so far.”
The development comes at an inopportune time, as the company continues to face mounting scrutiny for its data security practices owing to its links to China.
