Kardashian websites hacked via unsecured API

Hundreds of thousands of subscriber records were accessed, but no payment details were revealed

The Kardashian family has been the subject of a hack that revealed subscriber details of more than 600,000 people.

Luckily for them, it was accessed by a developer who told the company behind the websites about it via a blog post rather than a malicious attacker who wanted to ruin the reputation of the Kardashian family.

The flaw was first discovered on Kylie Jenner's website, but 19-year-old developer and CEO of communly.com Alaxic Smith then discovered the same API was used on other sites run by the family.

He managed to find the first and last names of 600,000 users on Kylie's website and was able to access the same information on Kim, Kendall and Khloe's websites too.

TechCrunch revealed he was also able to, "create and destroy users, photos, and videos," making it a very powerful flaw for malicious hackers who may want to cause damage.

Whalerock Industries, the company running the group of websites said it took down the API as soon as it was made aware of the problem.  

"Shortly after launch, we were alerted that there was an open API. It was promptly closed. Our logs indicate that the author of the blog post was able to access only a limited set of names and email addresses," it said in a statement.

The websites don't handle payments of any kind, so other sensitive information such as card details or bank account information was not available to Smith.

The Kardashian websites launched alongside apps just a few days ago and almost 900,000 people signed up to the service, which costs $2.99 a month.

Mark James, security expert at IT security provider ESET, said: "This is what can happen when you take a massive, potential money making scenario and apply an urgency to get it off the ground without thoroughly looking into the security aspect of how you're going to protect all the vulnerable peoples data you will collect.

"They receive the monetary benefits so they should be involved in making sure that the right people look after it and as much money that's needed is ploughed into making it secure. We will see more and more celebrities utilising this avenue for exposure and with that comes the risk of more people trying to get access to that data, some may not make it public until after they have used and abused it."

Featured Resources

How to scale your organisation in the cloud

How to overcome common scaling challenges and choose the right scalable cloud service

Download now

The people factor: A critical ingredient for intelligent communications

How to improve communication within your business

Download now

Future of video conferencing

Optimising video conferencing features to achieve business goals

Download now

Improving cyber security for remote working

13 recommendations for security from any location

Download now

Recommended

IT security awareness and training firm KnowBe4 acquires MediaPRO
Acquisition

IT security awareness and training firm KnowBe4 acquires MediaPRO

3 Mar 2021
High-risk email security threats increased by 32% last year
phishing

High-risk email security threats increased by 32% last year

3 Mar 2021
The top 12 password-cracking techniques used by hackers
Security

The top 12 password-cracking techniques used by hackers

3 Mar 2021
Microsoft Exchange targeted by China-linked hackers
zero-day exploit

Microsoft Exchange targeted by China-linked hackers

3 Mar 2021

Most Popular

Star Alliance passenger data stolen in SITA data breach
data breaches

Star Alliance passenger data stolen in SITA data breach

5 Mar 2021
I went shopping at Amazon’s till-less supermarket so that you don’t have to
automation

I went shopping at Amazon’s till-less supermarket so that you don’t have to

5 Mar 2021
How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

26 Feb 2021