Computer Security Technology Ltd

+44 (0)20 7621 7836 LinkedInTwitter

+44 (0)20 7621 7836 CSTL LinkedInCSTL Twitter

September 18, 2014

Mozilla leaks thousands of developers’ emails and passwords

It's the stuff of nightmares for any business but when you're a major name in web development, a data leak is all the more embarrassing. Read how Mozilla have moved to reassure users following a breach which dates back to June.

Data security is a major concern for all businesses these days with large organisations every bit as prone to exposure as SMEs. The company behind the Firefox web browser discovered this to its cost earlier this year, when it accidentally exposed 76,000 email addresses and 4,000 encrypted passwords of its own community members.

Mozilla has now owned up to the technical malfunction, which was first noticed on June 23, after a member of its developer network discovered a ‘data sanitisation process’ had gone awry.

Developers who had their details leaked were subsequently notified and advised to change their passwords as soon as possible.

76,000 email addresses and 4,000 passwords exposed

Stormy Peters, Mozilla’s director of developer relations, said: "The issue came to light... when one of our web developers discovered that, starting on about June 23, for a period of 30 days, a data sanitisation process of the Mozilla Database Network (MDN) site database had been failing, resulting in the accidental disclosure of MDN email addresses of about 76,000 users and encrypted passwords of about 4,000 users on publicly accessible servers."

"As soon as we learned of it, the database dump file was removed from the server immediately, and the process that generates the dump was disabled to prevent further disclosure," Peters added.

Mozilla, who place a lot of emphasis on the privacy and security of their services, was also in the spotlight back in 2010 when a loophole in its software was discovered by cyber criminals, allowing them to infect computers and malware. The security breach forced the German government to advise that people switch to a different browser.

"As soon as we learned of it, the database dump file was removed from the server immediately, and the process that generates the dump was disabled to prevent further disclosure," Peters added.


In the same year, a database containing user IDs and passwords was also accidentally leaked to the public, affecting more than 44,000 users.

"We're also taking a look at the processes and principles that are in place that may be made better to reduce the likelihood of something like this happening again," said Peters.