Mollom Security Breach

Over the week-end, I received an email from Mollom notifying me that they had discovered a security breach. According to their official blog post on the matter, the breach was discovered on August 21st. Mollom is a service managed by Acquia, a commercial open source software company providing products, services, and technical support for the open source Drupal social publishing system. The service works in a similar fashion to Akismet in that it scans messages such as comments to determine whether or not they are spam.

This is an important security notice from the Mollom team. On August 21, we identified a breach of one of our Mollom servers. Our subsequent investigation showed that unauthorized users gained access to Mollom servers and were potentially able to access Mollom data. Today we have closed the security loophole used to gain access and taken measures designed to prevent future breaches.

Data that may have been compromised includes usernames, account contact information, passwords, Mollom public and private keys, and billing transaction logs. PayPal account information was NOT stored on the affected servers.

At this time, we have no evidence that any malicious activity took place with customer data. To help assure this continues to be the case, in addition to the measures described above, we have changed all Mollom user account passwords.

Mollom has automatically reset all user account passwords to access the administrative interface. This means you’ll need to access the following URL in order to reset your password.

The bottom line is if you signed up to use Mollom free or as a paid customer, you should reset your password and keep a close eye on your financial records, especially if you have or had a paid account even though credit card information was not stored on the affected server. The unauthorized access was NOT a direct result of a vulnerability within Drupal. If any additional information is discovered during their investigation, the Mollom team will continue to update the blog post.