Even the suggestion of hacking can cause blow-out in the media and on social networks. It was Tik Tok’s turn to face the fire in early September 2022, when allegations of a data breach became public. This is what happened.
Timeline of an Alleged Hacking
On September 3, 2022, someone using the handle AgainstTheWest posted supposed screenshots on a message board relating to a TikTok and WeChat breach, adding that it hadn’t been decided whether the data allegedly stolen would be sold or publicly released. AgainstTheWest also claimed to have stolen 2 billion records and linked two alleged samples and a video of a set of database tables. On the same day, someone named BlueHornetAgainstTheWest claimed on Twitter to have extracted some backend source code.
On September 6, a TikTok spokesperson said that TikTok’s security team investigated and found that it had not been TikTok’s backend source code that had been stolen. A web security consultant found matches in the “leaked” files but said that some of the details within them could have been constructed from data accessible to the public. The matter was all in all “inconclusive”.
A discussion on a Hacker News forum suggested that the “leaked data” had not actually come from TikTok but from a database belonging to a third-party connected to TikTok for the purpose of marketing and e-commerce, as well as third-party sources unaffiliated with TikTok. A well-known cyber threat intelligence analyst confirmed that the data had likely come from a Chinese company based in Hangzhou City.
The AgainstTheWest and BlueHornetAgainstTheWest accounts were banned and suspended on their respective platforms. Nevertheless, as a precaution, TikTok users were encouraged to change account passwords and activate two-factor authentication.
Interesting Events Before and After the Alleged Hacking
In February 2022, TikTok settled a Canadian class action regarding data collection for $2 million — meaning that issues related to data are not new for the social media platform.
Interestingly, shortly before September 3, Microsoft had identified a vulnerability that may have allowed cyber attackers to access — and possibly modify — TikTok profiles and related information. This would make private videos public, upload videos, and even send messages purportedly on behalf of TikTok users. TikTok accounts had the potential to be exposed to a “one-click takeover exploit”. TikTok claimed that the cyber security issue had only affected older versions of the Android application and that it had been fixed. Notably, the issue of TikTok user data has emerged before, even forming the basis for civil lawsuits.
Literally, on the day before word spread about the alleged hacking, Bloomberg reported on U.S. President Biden and his government’s options when it came to curbing investment in the Chinese technology sector because of questions over whether China could access the data of U.S. customers.
On September 16, the Washington Post published an article that Beijing company ByteDance — the owner of TikTok — was offering investors the chance to sell their shares back in light of TikTok declining to go ahead with a public offering. ByteDance wanted TikTok to earn back trust and address concerns coming from both China and the United States and was moving to isolate TikTok from its other applications, Douyin and Jinri Toutiao.
Managing the Crisis
Whenever cybercrime has been alleged and publicised, crisis management becomes integral to how much the fallout can be minimised. Just over a year before this latest TikTok hacking scandal, T-Mobile had its latest data breach and, according to Forbes, demonstrated good crisis management instincts and practice.
In 2017, Equifax experienced its own data leak. It took months for the company to confirm the data breach, and since some shareholders had sold their stocks in the meantime, reports of insider trading allegations also arose. There was a significant turnover in the ranks of the upper management, and legislation punishing credit reporting companies that are breached was briefly considered. Equifax apparently spent over a billion dollars in the aftermath of the data breach, and its financial rating was downgraded by Moody’s. There was also a class action lawsuit making its way through the courts.
Like T-Mobile, TikTok took the earliest possible opportunity to address the allegations of hacking publicly. It mobilised its security team and shared its findings through updates. Although TikTok tried to deflect the controversy onto third-party affiliates (and non-affiliates) and clarified the nature of the alleged stolen information, the incident is still fresh in the minds of the public and government.
Prevention Is Key When It Comes to Cyber Security
Cybercrime can happen to everyone. SMEs may be wondering how they can protect their customer’s sensitive data when corporate powerhouses like TikTok have elite information security teams and seemingly infinite resources. Thankfully, there are solutions and service providers that care about companies like yours. grenke has always offered clients the peace of mind that through their technologies, they can optimise their business operations. This includes keeping their customer databases secure.
Our advice is: Make sure that you fortify your business against the very real threat of cyber attacks and privacy leaks.
