Trello Data Breach: 15 Million Users Affected

Hackers stole information from over 15 million Trello users in a recent data breach. While Trello’s internal systems weren’t compromised, attackers exploited a security flaw in an external tool called an API (Application Programming Interface), which allows developers to access data.

What Happened: Exploiting an Unsecured API

Trello is a project workflow management tool helping teams organise projects, meetings, new hires, and tasks. Trello is no small company, supporting large organisations such as UNICEF in planning and delivering projects.

Unfortunately, the bigger they are the harder they fall, and in this case, Trello failed to secure an external service made accessible to developers for building apps and integrations.

It appears that Trello failed to properly authenticate users querying the API, i.e. checking users and data requests. This allowed nefarious cyber criminals to utilise the API without proper identity checks. In turn they used trial and error to guess email addresses (otherwise known as a brute-force attack), looking for accounts which had been registered using a specific email. They did this by creating a list of over 500 million public email addresses and entering each address into the Trello API. If the API found a Trello account associated with that email address, it returned full Trello account information excluding Passwords and security information. If the email address did not match an account, the cyber criminals would simply try the next email address.

Out of the 500 million email addresses tried, 15 million Trello accounts were found, hence the data loss. A single user by the name of “emo” put the data up for auction on a deep web forum, uploading a small sample to prove the breach’s legitimacy.

The Danger: Combining Breached Data for Attacks

Hackers can combine stolen data from this breach with information from other leaks to gain access to users’ accounts. For example, Imagine a hacker who obtains your email address from this breach and also has your password from another recent data leak. They could combine this information to try logging into your Trello account, potentially gaining access to sensitive project details, client information, or personal documents you might have stored there. This could lead to financial losses, reputational damage, or even identity theft.

Protecting Yourself: Change Passwords & Enable MFA

If you are a Trello user, we recommend that you change your password and enable multi-factor authentication (MFA) for extra security.

Beyond Trello: Secure Your Digital Footprint

The learning point from the Trello data breach is to create unique passwords for every website and service you use. Every password you reuse, every account you neglect, becomes a potential entry point for hackers. Prioritise your digital security and build a strong wall against unauthorised access. It’s also important to understand your digital footprint, and to close accounts down when you no longer need them. Take control of your online data!