There are more technical details of the attack here - https://www.timehop.com/security/technical https://www.timehop.com/security/technical "On December 19, 20

There are more technical details of the attack here - https://www.timehop.com/security/technical https://www.timehop.com/security/technical "On December 19, 2017 an authorized administrative user's credentials were used by an unauthorized user to log into our Cloud Computing Provider. This unauthorized user created a new administrative user account, and began conducting reconnaissance activities within our Cloud Computing Environment. For the next two days, and on one day in March, 2018, and one day in June, 2018, the unauthorized user logged in again and continued to conduct reconnaissance." So someone logged into their Cloud Provider backend using a user/pass, created an admin account, and watched for 6 months before trying database extraction. Means a few things went wrong: * First, they had a guessable user/pass or, more likely, it was compromised some other way (social engineering, former employee, or it was in an email account that was itself compromised). * Second, they had no 2FA on their cloud provider logins. Given that this login allows the creation of admin accounts, that's a pretty big oversight * Third, they had an account with admin privileges running around for 6 months without anyone noticing. It kept its activity very limited, but a routine audit of all admin accounts would have found the new account. An alert that warned if a new admin account was created would have found it. So well done to TimeHop for coming forward with such a full and clear explanation, but this was a very preventable attack.