Data Breach - Cyber Security

Running Head: Data Breach

1
Data Breach
Data Breach
A US based fitness brand company named Under Armour fell into prey of a significant data
breach which was linked to one of its subsidiary called ‘MyFitnessPal’. Under Armour owns the
MyFitnessPal software which is a website and a mobile application used for keeping track of the
daily activities like exercise, diet and body health.
What the attacker did during the breach?
Under Armour announced that some 150 million accounts of its users were compromised during
the data breach which was marked as one of the biggest data breach hacks in the history. The
hackers were able to breach the Under Armour’s MyFitnessPal app compromising the personal
details of the users like the usernames, passwords, email addresses etc. (Caplan, 2017). The
attacker was able to get all the personal details of millions of account and was swimming in login
credentials. Although the payment details of the cards were not compromised yet the data breach
was said to be one the largest in the history. The attackers were able to gain access to large trove
of millions of email addresses of users which are considered valuable for a cyber-criminal. These
stolen emails can be used to boost the stock prices by dumping schemes through emails
(Maringer et al., 2018).
How the attack was made and what was the threat vector?
The intrusion was detected by the company within a week of the breach and investigation was
laid down immediately to find the root cause of the breach. The company was able to protect
some sensitive information by protecting the passwords by hashing them or by converting the
stored password into indistinct strings of characters. Despite this measure, the company later
admitted that it had hashed only few passwords using a certain robust and strong function called
Bcrypt, while the remaining passwords were protected by a redundant method of hashing called
SHA-1. The SHA-1 is known to have its flaws and is a weak scheme for password encryption.
The attackers were able to get in to the system through this link by cracking some part of the
password which was stolen by them without any trouble. This weak link was a like a get-in
invitation to the hackers and they easily got out by extracting the details of the users. The threat
vector included the data of around 150 million users from across the world having some personal