Dailymotion Hacked: 85 Million Accounts Stolen?

Yes, Dailymotion was hacked in 2016, and data from approximately 85 million user accounts was stolen. The breach exposed email addresses, usernames, and hashed passwords, though the company stated that financial information was not compromised. This article explains what happened, what data was taken, how Dailymotion responded, and what it means for your account security.

Background: The 2016 Dailymotion Breach

In October 2016, Dailymotion, a major video-sharing platform, suffered a significant data breach. The attack was part of a larger campaign targeting multiple tech companies, and it exploited a known vulnerability in an outdated version of the content management system used by the site. The attackers gained access to the user database and exfiltrated records for roughly 85 million accounts.

Dailymotion confirmed the breach in a notification to affected users, stating that the stolen data included email addresses, usernames, and hashed passwords. The company emphasized that it did not store credit card numbers or other payment details, so those were not at risk. However, the breach was serious because many users reuse passwords across multiple sites, making them vulnerable to credential stuffing attacks.

What Data Was Stolen?

The stolen data set from the 2016 Dailymotion breach included:

• Email addresses
• Usernames
• Hashed passwords (using the bcrypt algorithm)
• Account creation dates and last login IP addresses (in some cases)

Notably, Dailymotion did not store payment information, so credit card numbers and bank details were not part of the breach. The company also stated that the hashed passwords were salted, which makes them harder to crack. However, weak passwords could still be guessed if the hash was weak or if the attacker used a dictionary attack.

How the Attack Happened

The attack vector was a vulnerability in an outdated version of Drupal, a popular open-source content management system. Drupal had released a security patch for the flaw, but Dailymotion had not applied it in time. The attackers exploited this vulnerability to gain administrative access to the site’s backend, then extracted the user database.

This incident highlights a common security pitfall: failing to keep software up to date. Even large platforms can be compromised if they neglect routine patching. The breach was discovered when Dailymotion noticed unusual activity and launched an internal investigation, which confirmed the intrusion and the scale of the data theft.

Dailymotion’s Response

After discovering the breach, Dailymotion took several steps:

• Immediately patched the vulnerability and reset all user passwords.
• Notified affected users via email, advising them to change passwords on Dailymotion and any other sites where they used the same credentials.
• Worked with law enforcement and cybersecurity experts to investigate the attack.
• Strengthened its security infrastructure, including improved monitoring and incident response protocols.

The company also urged users to enable two-factor authentication (2FA) if they had not already, though 2FA was not widely available on the platform at the time. The breach was reported to relevant data protection authorities, and Dailymotion faced scrutiny over its security practices.

What This Means for Your Account

If you had a Dailymotion account in 2016, your data may have been exposed. Even though passwords were hashed, it is crucial to assume that your email address and username are now public. This can lead to phishing emails, spam, and targeted attacks. If you reused your Dailymotion password on other sites, those accounts are also at risk.

To protect yourself:

• Change your Dailymotion password immediately if you haven’t already.
• Use a unique, strong password for every site.
• Enable two-factor authentication wherever possible.
• Monitor your email for suspicious activity and be wary of unsolicited messages.
• Consider using a password manager to generate and store complex passwords.

Common Misconceptions

One common misconception is that the breach involved credit card data. Dailymotion explicitly stated that no financial information was stored, so that data was not compromised. Another misconception is that the breach was recent; it occurred in 2016, but the stolen data may still be circulating on the dark web. Some people also believe that hashed passwords are impossible to crack, but weak or common passwords can be guessed with brute-force or dictionary attacks, especially if the hash algorithm is outdated.

Frequently Asked Questions

How do I know if my Dailymotion account was affected?

Dailymotion sent email notifications to affected users in 2016. If you no longer have that email, you can check breach notification services like Have I Been Pwned, which lists the breach and allows you to search your email address.

What should I do if I used the same password on other sites?

Change your password on every site where you used the same credentials. It’s best to use a unique password for each account, and a password manager can help you maintain that without memorizing dozens of passwords.

Is my Dailymotion account still at risk?

Dailymotion reset all passwords after the breach, so your current account is likely safe if you’ve changed your password since then. However, if you haven’t logged in for years, the account may still be active and vulnerable if you haven’t updated your password.

Can the stolen passwords be used to access my account now?

Since Dailymotion reset all passwords, the stolen hashes are no longer valid for login. However, if you reused the same password on other sites, those accounts could be compromised. Always use unique passwords.

Did the breach affect my personal messages or videos?

No, the stolen data was limited to account information (email, username, hashed password). Private messages and video content were not part of the breach, as the attackers focused on the user database.

Lessons Learned

The Dailymotion breach serves as a reminder that no online platform is immune to cyberattacks. It underscores the importance of keeping software updated, using strong and unique passwords, and enabling two-factor authentication. For users, the key takeaway is to never reuse passwords across sites and to regularly monitor your accounts for suspicious activity. While the breach was significant, Dailymotion’s response and the fact that financial data was not exposed mitigated some of the potential damage. Still, the incident remains a cautionary tale in the history of data breaches.

Related

• Scaling Telecom Manufacturing: Assembly to R&D
• Print in Place 3D Printer Model Meaning
• Remove GPT Protective Partition? Safe Steps