Western Digital hacked: Your deeply personal data might be stolen

If you haven’t heard, Western Digital had a pretty serious security breach in March of this year. How serious? Serious enough that the company manually suspended its My Cloud service for over a week, during which customers lost all access to their remote files. Six weeks later, the company has published the results of its internal investigation, and it isn’t pretty.

According to emails sent to Western Digital customers (via Bleeping Computer), the company says that hackers were able to obtain a database of customers containing names, phone numbers, shipping addresses and billing addresses, email addresses, and partial credit card numbers. Password data was also stolen, though those files were encrypted, hashed, and “salted,” meaning that the danger for those particular files is particularly low.

The data appears to be mostly connected to Western Digital’s online store, not the My Cloud service…though there’s probably a good bit of overlap in those two groups. Western Digital is closing its online store for the time being, with access expected to return next week.

According to Bleeping Computer, the hackers showed evidence of at least some level of access to Western Digital’s network as recently as April 28th, presumably in an attempt to extort ransom money. Anyone with a Western Digital store account or My Drive account is encouraged to change their password (and might want to look into a password manager, too).