A Toronto-based story publishing site says someone may have “improperly accessed” personal information about its users, including their email addresses and dates of birth.
The statement made Monday by Wattpad Corp. was an update on the breach of security controls first announced July 14. At that time it said no financial information, private messages or phone numbers were accessed.
But the update gave more detail about the information that was gained. Some of it could be used for phishing and impersonation, and the person who accessed the data could have seen or copied the following:
- Email addresses
- Date of birth and gender (if provided by users)
- IP address upon sign up, if signed up before 2017
- Profile display name
- Account name and salted and cryptographically hashed passwords
- Responses provided to surveys distributed in 2015 or earlier
- List of Paid Stories and chapter titles purchased by a user’
- Any third-party account IDs, such as Google or Facebook. However, it noted that passwords associated with third-party accounts are not stored on Wattpad systems and are unaffected.
“Given the type of information that we have about our users, we think it’s unlikely that this will meaningfully affect our users,” the company said in an FAQ page on the incident, although the data accessed could include usernames, dates of birth and email addresses.
“We want to stress that Wattpad does not store plain text passwords,” the statement said. “All Wattpad passwords are encrypted. User stories, private messages, and phone numbers were NOT part of this incident. Financial or payment information are not stored on affected systems and, based on the investigation to date, were not affected in this incident.”
The company recommends users change their Wattpad passwords and passwords on other sites that use the same password.
Asked on Wednesday for the number of affected people who are being notified, director of communications Kiel Hume said he had nothing to add beyond the published statement. Nor could he comment on how the company could say it’s unlikely the incident will meaningfully affect users although names, dates of birth and email address could have been seen.
Wattpad is a platform that allows writers to publish stories on its website or through a mobile app. Most users post for free, competing to build an audience. Often authors add content a chapter at a time. There is an invitation-only program where some writers can charge for their content to be read. Authors retain all publishing rights. Wattpad says it can facilitate content being published as a book, TV or movie script.
Company CEO and co-founder Allen Lau is a University of Toronto electrical engineering graduate and entrepreneur. He is a co-founder of Two Small Fish Ventures, a fund that invests in Toronto and Waterloo-based early-stage internet companies. He also co-founded FeedM8, a mobile advertising company that was later acquired, and Tira Wireless, a firm that optimizes content for mobile delivery.
The site says it has 80 million monthly visitors. It makes money partly through partnerships with brand names like Coca-Cola, retailer JC Penny, Microsoft and others. For example, when Microsoft created a chatbot called Zo to help the company learn more about artificial intelligence and communications it partnered with Wattpad for a WriteWithZo contest. Two Wattpad influencers wrote original stories based on their conversations with Zo, and prompted their followers to do the same. A case study on the Wattpad site says the campaign drove 247,000 reads and was deemed a “huge success.” Netflix created awareness and anticipation for the release of the Wattpad story-turned-film called The Kissing Booth through a contest, asking Wattpad users to share a high school romance story inspired by story. Ultimately, the case study says, the contest took over Wattpad’s Romance profile.
Another way it makes money is by buying developing larger versions of submitted stories. For example, in May it said it is developing film versions of the Wattpad stories The Hound and What Happened That Night through a development fund. Last month the company announced a partnership with Australia’s Screen Queensland, a Queensland government-owned company to promote local production, to develop TV and film projects.
News of the data incident was confirmed by the company on July 14th when it said Wattpad was “aware of reports that some user data has been accessed without authorization. We are urgently working to investigate, contain, and remediate the issue with the assistance of external security consultants.”