The details of 13 million Mac users have been leaked


Tim Cook

REUTERS/Robert Galbraith

Apple Inc CEO Tim Cook speaks on stage about the new iPad during an Apple event in San Francisco, California October 22, 2013.

MacKeeper, an anti-virus tool for Apple Mac users, has leaked the details of over 13 million users, according to researcher Chris Vickery.


The flaw has now been addressed.

Vickery found a section of the MacKeeper website that, when accessed without a password or username, allowed him to see the details of customer information, including names, email addresses, user names, passwords, phone numbers, system information, and more.

Complimentary Tech Event
Discover the future of SaaS in India
The 6-part video series will capture the vision of Indian SaaS leaders and highlight the potential for the sector in the decades to come.Watch on Demand
Our Speakers
Girish Mathrubootham
Brian E. Taptich

Beyond this error, Vickery found that the passwords MacKeeper stored were not secure. Passwords are protected by a "hashing" algorithm that takes the plain text - e.g. "password1234" - and turns it into something only a computer can read. MacKeeper was using a outdated, and easily crackable, algorithm, according to Vickery.

The MacKeeper team wrote a blog post detailing the steps they had taken to address the issue.


"Analysis of our data storage system shows only one individual gained access performed by the security researcher himself," they wrote. "We have been in communication with Chris and he has not shared or used the data inappropriately."

This is all good news, but the fact that the company - which deals in computers - left such a large amount of data available to anyone is worrying.

Business Insider received the following comment from MacKeeper:

Kromtech is aware of a potential vulnerability in access to our data storage system and we are grateful to the security researcher Chris Vickery who identified this issue without disclosing any technical details for public use. We fixed this error within hours of the discovery.

The company went on to reassure users that credit and debit card information is processed by a third-party and was never at risk. "We will continue to take every possible step to protect the data of our customers from the evolving cyber threats that companies both large and small face on a daily basis," it said.


NOW WATCH: Here's how to find out your Uber rating