After disclosing a breach earlier this week, Stack Overflow has confirmed some user data was accessed.
In case you missed it, the developer knowledge sharing site confirmed Thursday a breach of its systems last weekend, resulting in unauthorized access to production systems — the front-facing servers that actively power the site. The company gave few details, except that customer data was unaffected by the breach.
Now the company said the intrusion on the website began about a week earlier and “a very small number” of users had some data exposed.
“The intrusion originated on May 5 when a build deployed to the development tier for stackoverflow.com contained a bug, which allowed an attacker to log in to our development tier as well as escalate their access on the production version of stackoverflow.com,” said Mary Ferguson, vice president of engineering.
“This change was quickly identified and we revoked their access network-wide, began investigating the intrusion, and began taking steps to remediate the intrusion,” she said.
Although the user database wasn’t compromised, “we have identified privileged web requests that the attacker made that could have returned IP address, names, or emails” for some users.
The company didn’t immediately quantify how many users were affected. Stack Overflow has 10 million registered users. Spokesperson Khalid El Khatib said “approximately 250 public network users” were affected. Ferguson said affected users will be notified.
Stack Overflow’s teams, business and enterprise customers are on separate, unaffected infrastructure, she said, and there’s “no evidence” that those systems were accessed. The company’s advertising and talent business is said to be unaffected.
In response to the incident, the company terminated the unauthorized access and is conducting an “extensive” audit of its logs to gauge the level of access gained by the attacker.