Mozilla confirms leak of 76,000 developer email addresses

The not-for-profit foundation behind the Firefox browser has admitted a serious data leak, exposing developers’ contacts and encrypted passwords. Members of Mozilla’s developer community have been alerted about an accidental leak of email addresses and encrypted passwords, after the failure of a “data sanitisation” process the organisation was carrying out.


Mozilla, which is most famous for its Firefox web browser, co-ordinates the development of a number of open-source software projects through the Mozilla Developer Network.


“Starting on about 23 June, for a period of 30 days,” the organisation warned developers, “a data sanitisation process … had been failing, resulting in the accidental disclosure of MDN email addresses of about 76,000 users and encrypted passwords of about 4,000 users on a publicly accessible server.”


The passwords were stored as salted hashes, an encryption process which renders it computationally impossible to retrieve the original password in a readable format, and Mozilla says that, by themselves, they “cannot be used to authenticate with the MDN website today”.


But it adds that “it is possible that some MDN users could have reused their original MDN passwords on other non-Mozilla websites or authentication systems”.

Stormy Peters, the company’s director of developer relations, says that“as soon as we learned of [the leak], the database dump file was removed from the server immediately, and the process that generates the dump was disabled to prevent further disclosure.


“While we have not been able to detect malicious activity on that server, we cannot be sure there wasn’t any such access.”


Beard confirmed as new CEO


The Mozilla Foundation recently named Chris Beard, its interim CEO, as the new permanent head of the Mozilla Corporation – a for-profit wholly owned subsidiary which publishes the Firefox browser. Beard had replaced Brendan Eich as CEO on a temporary basis in April, after the latter resigned owing to controversy surrounding his donations to a campaign against same sex marriage.


“We know why people are hurt and angry, and they are right: it’s because we haven’t stayed true to ourselves,” said Mitchell Baker, the Mozilla Foundation’s executive chairwoman, at the time. “We didn’t act like you’d expect Mozilla to act. We didn’t move fast enough to engage with people once the controversy started. We’re sorry. We must do better.”


Confirming that Beard was to stay on as CEO on a permanent basis,Baker said in a blog post that “over the years, Chris has led many of Mozilla’s most innovative projects.

“We have relied on his judgment and advice for nearly a decade. Chris has a clear vision of how to take Mozilla’s mission and turn it into industry-changing products and ideas.”


The guardian.com