One of the largest repositories for Docker container images has now become the latest victim of a security breach. As confirmed by the firm, the Docker Hub data breach resulted in the compromise of sensitive information. The incident affected around 190,000 user accounts.
The Docker Hub Data Breach
According to the latest reports, the Docker container image repository Docker Hub suffered a data breach. News about the incident surfaced online after the firm sent emails to users notifying them of the breach. The company has also put up a security notice on its website.
As disclosed, the firm noticed unauthorized access to one of their databases on April 25, 2019. The affected database enclosed part of the non-financial data of the users.
“There was a brief period of unauthorized access to a Docker Hub database.”
While Docker Hub marks the duration of the breach as a brief period, it certainly sufficed to affect around 190,000 accounts. Nonetheless, the number of affectees constituted less than 5% of the Docker Hub users.
Regarding the kind of information exposed, Docker Hub stated,
“Data includes usernames and hashed passwords for a small percentage of users as well as GitHub and Bitbucket tokens for Docker autobuilds.”
Whereas, they did confirm that the Docker Official images remained unaffected during the incident because of the added security protocols.
“No Official Images have been compromised. We have additional security measures in place for our Official Images including GPG signatures on git commits as well as Notary signing to ensure the integrity of each image.”
Docker Hub Asking Users To Reset Passwords
Since the breach did expose some hashed passwords, Docker Hub has asked all the users to reset their passwords.
“If you directly received an email from Docker about this incident, you may have been impacted. If you have received a password reset link, your password hash was potentially exposed.”
While the users directly affected in the breach would have received an email in this regard as the one shared in this tweet.
The firm have also revoked Docker autobuild tokens, those using this service have to relink their GitHub or Bitbucket repositories to Docker Hub.
Take your time to comment on this article.