Kaneva Data Breach (2016): What Was Exposed & What To Do

What happened

In July 2016 a data breach at Kaneva exposed 3.9 million user records. The service, which allowed users to build and explore virtual worlds, is now defunct. Public reporting on the incident states that the data included email addresses, usernames, dates of birth and salted MD5 password hashes. No further details on the method of intrusion or exact timing of the compromise have been disclosed.

How a breach like this happens

Incidents involving online service providers often begin with attackers gaining access to internal systems through unpatched software, stolen credentials or misconfigured databases. Once inside, the attackers can copy user tables that contain login details and personal identifiers. The stolen data is then sometimes posted or sold on forums that trade in such material. Salted password hashes, as noted in this case, indicate that the service stored credentials in a hashed rather than plaintext format, though the strength of the hashing method still determines how quickly the original passwords can be recovered.

Kaneva and its sector

Kaneva operated as a virtual-world platform where users created profiles and interacted in three-dimensional environments. Services of this type routinely collect account credentials, contact information and basic biographical data to manage registrations and enforce age restrictions. A breach at such a platform is consequential because the user base often includes younger individuals and because the combination of email addresses and birth dates can support identity-related misuse even after the service itself has closed.

What data was at risk

The records reported as exposed contained four categories of information.

• Dates of birth
• Email addresses
• Passwords (stored as salted MD5 hashes)
• Usernames

Why it matters

Email addresses and usernames can be used to launch phishing campaigns that reference the virtual-world service and appear credible to former users. Dates of birth add detail that can assist in social-engineering attempts or account-recovery processes at other sites. Although the passwords were stored as salted hashes, older hashing methods can be attacked offline once the data is obtained, potentially allowing access to any accounts where users reused the same password. For the organisation, the incident contributed to the permanent closure of the platform and illustrates the long-term liabilities that accompany stored user data.

What to do if you're exposed

Anyone who recalls creating a Kaneva account should change the password on that email address and on any other service where the same password may have been used. Enabling two-factor authentication on email and other important accounts reduces the chance that a leaked password alone will grant access. Readers can also run a free exposure scan of their email address against known breach data to check for additional appearances of their information.

AICompiled with AI assistance from public sources and published under our editorial standards.