14 DAY TRIAL // Australian software maker Atlassian announced that suspicious activity was detected on computers using the HipChat messaging service and that the attackers gained unauthorized access to customer information.
HipChat is an instant messaging (IM) platform compatible with both desktop (Windows and OS X) and mobile (Android and iOS) operating systems.
A monthly subscription ($2 / €1.77 per user) is available, offering an extended list of features that includes 1-to-1 voice and video calling, screen sharing, and unlimited file storage.
Affected users asked to change their passwords
Head of the Atlassian security division Craig Davies alerted of the breach on Saturday, saying that the information exposed belonged to less than two percent of the clients and included names, usernames, email addresses, and passwords.
The method used by the attackers to gain access to the systems has not been revealed, but the security team managed to block the intrusion as soon as it was discovered.
Davies says that the service protects customer passwords and stores them in an encrypted form, which has them salted and hashed. As such, the risk of an attacker learning the strings is minimum.
However, out of caution, a password reset was triggered for all affected HipChat user accounts, as well as all Atlassian services linked to the same email address.
The investigation of the incident did not point to any evidence that payment information was accessed by the intruders, Davies says in the official announcement.
HipChat aims high in 2015
“We take our responsibility to protect you and your data very seriously, and we’re constantly enhancing the security of our service infrastructure to keep you and your data safe. While recent events with other large services have demonstrated this type of activity is increasing, so too is our vigilance in blocking and addressing it,” Davies added.
HipChat is designed for collaboration purposes and it has become quite popular with companies. In 2014, the service facilitated the exchange of four billion messages, four times more than in the previous year.
In 2015 the company aims at shaping its service to attract smaller groups too, not just corporate teams.
The recent attack comes after Atlassian released security patches for plugging a critical remote code execution bug (arbitrary Java code by exploiting an OGNL Double Evaluation vulnerability) that affected four of its products, Confluence up to 5.5.7, Bamboo up to 5.7.1, and FishEye and Crucible up to and including 3.6.1.