← Times Internet

2015 — Gwyn D'Mello reports that an online music site was…

2015 12.5M records affected Share on X

Data compromised

Credentials, Personal

Technical writeup

Gwyn D'Mello reports that an online music site was hacked to make a point after they failed to secure their site despite multiple warnings: A white hat hacker used an exploit to gain access to Gaana.com user credentials, because they neglected to fix a security bug he reported. It seems Gaana.com was hacked a few hours ago, with user data and credentials being accessed. But, in a fortunate turn of events, the responsible party turned out to be a white hat hacker. [__] Mak Man, the hacker responsible, detailed the incident in a Facebook post, saying he had reported the exploit to the website's team on multiple occasions, but was ignored. He says he was trying to bring attention to the glaring hole in their security, and had no malicious intent. While users' credentials were accessed, Mak Man has since said that the data was being queried in real time, and was not stored or copied on their server. The site notes that all its passwords were hashed. See their tweets about the incident.

Root cause

Hacking: SQLi, Exploit vuln

References