Tumblr finds major security bug that could have leaked people's most personal information
The site has found no evidence the bug was abused, it said
![The Tumblr application is seen on a mobile phone in this illustration photo March 7, 2018](https://static.independent.co.uk/s3fs-public/thumbnails/image/2018/10/18/16/tumblr.jpg)
Support truly
independent journalism
Our mission is to deliver unbiased, fact-based reporting that holds power to account and exposes the truth.
Whether $5 or $50, every contribution counts.
Support us to deliver journalism without an agenda.
![Louise Thomas](https://static.independent.co.uk/static-assets/support-us/louise-thomas.png)
Louise Thomas
Editor
Tumblr has found a major security bug in its platform that could have leaked people's most personal information, it has said.
A problem with the innocent looking "recommended blogs" screen could have given up people's email addresses, passwords, old accounts, and where they were.
The issue has now been fixed and there is no evidence that it was actually used, Tumblr said. Users don't need to do anything to keep their account secure.
The bug was discovered through Tumblr's bug bounty programme, which pays security researchers if they are able to find problems with its software. That means that experts can get money for discovering the loopholes but not use them to steal people's information.
It was fixed within 12 hours of it being reported and Tumblr has taken extra steps to make sure that it is able to see and spot any similar bugs in the future.
The recommended blogs feature usually does exactly what it says: showing other blogs that a person might be interested in, if they're logged into their account.
But the bug meant that when a blog appeared in that module it could be hacked to find out information about the person who runs it.
Tumblr said it wouldn't be able to find out what specific accounts had been affected by the bug, but that it was "rarely present".
"It’s our mission to provide a safe space for people to express themselves freely and form communities around things they love," the company wrote in a blog post. "We feel that this bug could have affected that experience. We want to be transparent with you about it. In our view, it’s simply the right thing to do."
Subscribe to Independent Premium to bookmark this article
Want to bookmark your favourite articles and stories to read or reference later? Start your Independent Premium subscription today.
Join our commenting forum
Join thought-provoking conversations, follow other Independent readers and see their replies
Comments