14 DAY TRIAL // ReverbNation, an online service launched in 2006 that helps musicians manage their careers and promote their songs, has issued an alert regarding a data breach it suffered in January 2014.
According to an email sent to some of its users, ReverbNation is claiming that they were just recently notified of a database breach after law enforcement have identified and charged an unnamed individual on hacking-related charges.
Attacker gained access to ReverbNation data via a cloud-hosting account
In various statements company representatives made online, it appears that the intrusion occurred when the attacker hacked a reputable cloud hosting service, stealing one of ReverbNation's backup files.
ReverbNation claims they did not store any kind of credit card data, and the individual only got his hands on user information like email addresses, encrypted passwords, names, addresses, phone numbers, and dates of birth.
Michael Doernberg, ReverbNation CEO and co-founder, warns that "although your password was encrypted it is possible for a person with enough computing power to guess an encrypted password by testing particularly weak or obvious passwords."
Besides the email, the company also sent out a written letter to all of its California-based users, as SC Magazine found out. Beyond the details mentioned above, this letter also warned users that their social security numbers and employer identification numbers may have also been leaked.
All users that registered prior to May 2014 are affected
This letter also contained extra information not found in the original email which informed users that the date range of the unauthorized access was, at most, January through May 2014.
Company representatives said they informed all users that had registered before May 2014 of the breach, and recommended they change their password.
Besides just changing their ReverbNation password, users were also urged to change passphrases for any other accounts where they may have reused the ReverbNation password.