Drupal website hack prompts password reset
Drupal.org falls victim to hackers, resulting in new passwords for users.
Hackers have gained unauthorised access to the user names, email addresses and passwords of a number of Drupal.org users.
The open source online content management firm's security and infrastructure team confirmed the website breach in a blog post last night, and stressed that websites running on its platform should not be affected.
We are still investigating the incident and may learn about other times of information compromised, in which case we will notify you accordingly.
"The Drupal.org security team and infrastructure team has discovered unauthorised access to account information on Drupal.org and groups.drupal.org," the blog post states.
"This access was accomplished via third-party software installed on the Drupal.org server infrastructure, and was not the result of a vulnerability within Drupal itself."
The platform itself is used to underpin blogs and enterprise applications, while the groups.drupal.org arm is where its users can congregate to work or receive support for their Drupal-based projects.
The blog post also confirmed that all Drupal.org account holders have had their passwords changed as a precautionary measure.
"Information exposed includes usernames, email addresses, country information, as well as hashed passwords. However, we are still investigating the incident and may learn about other times of information compromised, in which case we will notify you accordingly," the post continued.
Sign up today and you will receive a free copy of our Future Focus 2026 report - the leading resource for IT decision-maker insight on priorities and investment areas in AI, security and more.
The company said it has no information to share at the moment about the identity of the attackers, but assured users it was doing all it can to prevent something similar happening again.
For instance, the company has introduced a number of infrastructure and application changes that have seen it "harden" its Apache web server configurations and introduce an anti-virus scanner that looks for malicious files being uploaded to the Drupal.org servers.
Further to this, it has also advised users to be on their guard against phising attacks in the wake of the hack.
"Beware of emails that threaten to close your account if you do not take the immediate action' of providing personal information," the post added.
"We do not store credit card information, [so] as a precaution we recommend you closely monitor your financial accounts if you made a transaction on association.drugal.org or if you use a password with your financial institution that is similar to your [one for] Drupal.org."
Caroline Donnelly was the news and analysis editor of IT Pro. Previously, she worked as a reporter at several B2B publications, including UK channel magazine CRN, and as features writer for local weekly newspaper, The Slough and Windsor Observer. She studied Medical Biochemistry at the University of Leicester and completed a Postgraduate Diploma in Magazine Journalism at PMA Training in 2006.
-
Shifting from traditional MDR to an AI-powered agentic SOCAs autonomous threats proliferate, relying on standalone AI tools is a major business risk. Here is how Arctic Wolf is setting the market standard to solve the AI trust problem
-
Tokenmaxxing means FinOps is more important than everNews With firms facing surging AI bills, FinOps techniques are more important than ever
-
1Password teams up with Anthropic to give Claude access to your credentialsNews A new ‘zero-exposure’ security framework allows agents to use stored credentials in the 1Password vault
-
We need to do something about passwordsPasswords are a fundamental aspect of access security, but recent password leaks have undermined their ability to protect data
-
Dashlane lifts the lid on attack that saw hackers download encrypted user vaultsNews The company said it has now informed all affected customers, and taken action to shut down the operation
-
The NCSC says it’s time to switch to passkeysNews UK security organization calls for companies to step up and offer more secure ways to login
-
AI agents are creating new identity security risks: 1Password wants to solve thatNews The Unified Access system from 1Password will help enterprises manage AI agent access across different devices and users
-
Using AI to generate passwords is a terrible idea, experts warnNews Researchers have warned the use of AI-generated passwords puts users and businesses at risk
-
Researchers called on LastPass, Dashlane, and Bitwarden to up defenses after severe flaws put 60 million users at risk – here’s how each company respondedNews Analysts at ETH Zurich called for cryptographic standard improvements after a host of password managers were found lacking
-
Thousands of exposed civil servant passwords are up for grabs onlineNews While the password security failures are concerning, they pale in comparison to other nations