Popular short-form social video service TikTok denied reports that it was breached by a hacking group, after it claimed to have gained access to an insecure cloud server.
“TikTok prioritizes the privacy and security of our users’ data,” the ByteDance-owned company told The Hacker News. “Our security team investigated these claims and found no evidence of a security breach.”
The denial follows alleged reports of a hack that surfaced on the Breach Forums message board on September 3, with the threat actor noting that the server holds 2.05 billion records in a humongous 790GB database.
“Who would have thought that TikTok would decide to store all their internal backend source code on one Alibaba Cloud instance using a trashy password?,” the hacking group known as BlueHornet (aka AgainstTheWest) tweeted over the weekend.
Bob Diachenko, threat intelligence researcher at Security Discovery, said the breach is “real” and that the data is likely to have originated from “Hangzhou Julun Network Technology Co., Ltd rather than TikTok.”
That said, it’s far from clear at the moment where exactly the data has come from and whether third-parties have access to this kind of information.
“This is so far pretty inconclusive; some data matches production info, albeit publicly accessible info,” security researcher Troy Hunt said in a tweet. “Some data is junk, but it could be non-production or test data. It’s a bit of a mixed bag so far.”
The development comes at an inopportune time, as the company continues to face mounting scrutiny for its data security practices owing to its links to China.
Update: In a follow-up statement shared with The Hacker News, the social media company reiterated its security team found no evidence of a security breach.
“We have confirmed that the data samples in question are all publicly accessible and are not due to any compromise of TikTok systems, networks, or databases,” a TikTok spokesperson said.
“The samples also appear to contain data from one or more third-party sources not affiliated with TikTok. We do not believe users need to take any proactive actions, and we remain committed to the safety and security of our global community.”
Additionally, the Twitter account of AgainstTheWest has since been suspended and allegations of the break-in have since been modified on Breach Forums to mention that “the breach is not from TikTok, and that he most likely was lying or didn’t even investigate it before making such outrageous claims.”
“AgainstTheWest has had a long history of lying about breaches or other things (saying he’s a state-sponsored hacking group… LOL) and this was just the tipping point,” pompompurin, the actor who launched Breach Forums earlier this March, said.