Hackers who exploited the infamous most bug heartbleed stole data from a UK parental website and the Canadian tax office.
According to Mumsnet, which has 1,5 million registered members, the government may have committed codes and personal messages before the necessary patches are passed. Also, the Canada Revenue Agency has announced that it has overcame 900 social security numbers.
These are the first confirmed "victims" of Heartbleed. As the Mumsnet founder, Jasmin Roberts, told the BBC, it became obvious that user data was at risk when it found that its username and password were used to publish an online message.
“On Friday April 11th it became apparent that the bug that became known as Heartbleed was used to obtain access on Mumsnet user account data' refers to an email to members of the website. “We have no way of knowing which members were affected by this. The worst case scenario is that each account's data was accessed."
As Roberts said, hackers who carried out the attack informed the site's administrators that the attack was linked to Heartbleed and informed them that the company's data was not safe.
As far as the Canadian service is concerned, it is noted that it was one of the first major operators to discontinue their online services due to the security problem in OpenSSL, used for communications security.
“Unfortunately, the CRA was tipped off by their security services governmentof Canada regarding a malicious infringement data of taxpayers, which took place within a period of six hours," it says in a message on its website.
"Based on our analysis so far, social security numbers of around 900 taxpayers have been overwhelmed by CRA systems by someone who has exploited Heartbleed."
Other systems that are thought to have been affected by Heartbleed are Imgur, OKCupid, Eventbrite, and the FBI website.
According to a Guardian report, Heartbleed also poses a risk to consumer devices such as smartphones, routers, and more. As noted, there is a risk that starts from data interception and goes as far as gaining control of a device. It is noted that Cisco has announced that some of its products are vulnerable to Heartbleed, including desktop phones, video conferencing software and VPN software.
