Heartbleed hacks hit Mumsnet and Canada's tax agency

A leading UK site for parents and the Canadian tax authority have both announced they have had data stolen by hackers exploiting the Heartbleed bug.

Mumsnet - which says it has 1.5 million registered members - said that it believed that the cyber thieves may have obtained passwords and personal messages before it patched its site.

The Canada Revenue Agency said that 900 people's social insurance numbers had been stolen.

These are the first confirmed losses.

The Mumsnet site's founder Justine Roberts told the BBC that it became apparent that user data was at risk when her own username and password were used to post a message online.

She said the hackers then informed Mumsnet's administrators that the attack was linked to the Heartbleed flaw and told them the company's data was not safe.

"On Friday 11 April, it became apparent that what is widely known as the Heartbleed bug had been used to access data from Mumsnet users' accounts," the London-based website added in an email to its members.

"We have no way of knowing which Mumsnetters were affected by this.

"The worst case scenario is that the data of every Mumsnet user account was accessed.

"It is possible that this information could then have been used to log in as you and give access to your posting history, your personal messages and your personal profile, although we should say that we have seen no evidence of anyone's account being used for anything other than to flag up the security breach, thus far."

The site added that it was forcing its members to reset any password created on or before Saturday.

:story: BBC News