Sophos Labs: Millions of blog owners around the world are being advised to consider their password security, after WordPress.com was hacked.
To its credit, Automattic – the company behind the WordPress.com blogging platform – didn’t mince its words or try to apply any spin to the incident, explaining it had suffered a “low-level (root) break-in to several of [its] servers, and potentially anything on those servers could have been revealed.”
We have been diligently reviewing logs and records about the break-in to determine the extent of the information exposed, and re-securing avenues used to gain access. We presume our source code was exposed and copied. While much of our code is Open Source, there are sensitive bits of our and our partners’ code. Beyond that, however, it appears information disclosed was limited.
WordPress’s gurus continue to investigate the security breach, and says it has taken steps to prevent it happening again.
It’s worth pointing out that the security incident only potentially affects blogs posted on WordPress.com, not sites which have decided to self-host their own WordPress blog using the software from WordPress.org.
So, until we know more, I think it would be sensible for all WordPress.com users to follow the advice – and consider if they are using a secure password. Better safe than sorry, after all.
Here’s how you change your WordPress.com password, if you think it might not be secure.
1. Go to Users / Personal settings
2. Choose a strong, unique password. (How to choose a good password and take care of it?)
We don’t know that the WordPress.com security breach gave the hackers access to bloggers’ passwords, but we do know that many internet users have chosen to use the same password on multiple websites. So if your password was stolen from one website, it could then be used to unlock many other online accounts – and potentially cause a bigger problem for you.
So always use unique passwords.
Furthermore, computer users should ensure they don’t use dictionary words as passwords as it is relatively easy for hackers to figure these out using electronic dictionaries that simply try out every word until they get the right one.
Even though your WordPress password may not have been compromised, it still makes sense and is good practice to make sure that you have a chosen a good, strong password now.