Flightradar24 password breach (18 Jun 2018)

(This is a text-extract, the HTML is littered with sendgrind.net tracking URLs... something something GDPR! As I did not consent :)
[Also, what more has been stolen than just the username/password column of the database....]

Date: Mon, 18 Jun 2018 13:13:53 +0000 (UTC)
From: "FR24 Security Team" <security@fr24.com>
Mime-Version: 1.0
Reply-to: security@fr24.com
Subject: An update on your account security
To: <email>
Message-ID: <xxxxx1.sendgrid.net>
List-Unsubscribe: <mailto:unsubscribe@post.fr24.com?subject=https://u708499.ct.sendgrid.net/asm/unsubscribe/<BIG TRACKING LINK>
X-SG-EID: <MORE TRACKING>
X-SG-ID: <EVEN MORE TRACKING>

Dear Flightradar24 user,



I regret to inform you that late last week we identified a security breach that may have compromised the email addresses and hashed passwords (see explanation below) for a small subset of Flightradar24 users (those who registered prior to March 16, 2016), including you. While we do not have any indication that your information was accessed, we still want to sincerely apologize for the breach and let you know what we're doing, and what we encourage you to do.


We do not store passwords in plain text on our servers. Instead we convert them into scrambled strings of characters (hashes) that are designed to be impossible to convert back. However, as a general precaution and because the hashing algorithm used in this retired part of our system no longer is considered sufficiently secure, we have decided to reset the passwords of all potentially affected users.
Click here to create a new password

https://www.flightradar24.com/premium/forgot/?email=<emailaddress>&token=<token>



If clicking the URL in this message does not work, just copy and paste it into the address bar of your browser. You can also visit flightradar24.com and use the password reset function at any time.


In case you’ve used the same password anywhere else, I strongly suggest you update it there as well.


Please note that no payment information has been compromised. Flightradar24 neither handles nor stores payment information. Instead, this is managed by our trusted partners Adyen and PayPal.


The security breach was limited to one server and it was promptly shut down once the intrusion attempt had been ascertained. Other actions, beyond the password reset for affected users, include a modern secure password hashing (in place since 2016) and further strengthening of access and authentication for our internal systems.


We take the protection of your information very seriously and will continue our thorough internal security review of our system and processes to see what more we can do to ensure that this never happens again. In order to comply with the EU’s General Data Protection Regulation (GDPR) article 33 (Notification of a personal data breach to the supervisory authority) we have also notified The Swedish Data Protection Authority (Flightradar24 is a Swedish company).


If you have any questions, I encourage you to contact us at support@fr24.com.


Sincerely,

Fredrik Lindahl
CEO, Flightradar24