Mass hack confirmed at comments plugin Disqus

Disqus will reset passwords for users of the popular comments plugin provider after a hack in which millions of credentials were taken by unknown attackers.

The hack was first discovered by Troy Hunt, an Australian security researcher and Microsoft most valued professional, who alerted Disqus to the breach.

In a security alert, Disqus said attackers took a snapshot of its user database from 2012 with information dating back to 2007.

This included user names, sign-up dates and last login dates for more than 17.5 million users. Salted passwords hashed with the crackable SHA-1 algorithm for a third of Disqus users were also leaked.

Disqus responded within a day to the breach, and as a security precaution, the service has reset passwords for all users affected by the hack.

No evidence of unauthorised logins to Disqus have been discovered so far, but the company said the email addresses revealed were in plain text and users may receive spam or other unwanted messages.

"Since 2012, as part of normal security enhancements, we’ve made significant upgrades to our database and encryption in order to prevent breaches and increase password security. Specifically, at the end of 2012 we changed our password hashing algorithm from SHA1 to bcrypt," read the blog post.

Disqus hosts approximately 50 million comments each month across hundreds of thousands of websites, including iTnews.