Social Blade has admitted to being hacked.

The hacking of a well-known data analytics tool that monitors YouTube and other major social media platforms has been acknowledged.

Social Blade insisted that no credit card information had been leaked in a statement that said it had been notified of a systems breach on December 14.

However, it stated that the responsible hacker offered other personally identifying information, such as email and internet protocol (IP) addresses, hashes used to hide passwords, client IDs, and authentication tokens for connected accounts, for sale on a dark web forum.

Social Blade is a data analytics tool based in the United States that tracks social media platforms like YouTube, Facebook, Twitter, and TikTok. It claims that its website receives seven million unique monthly visitors.

According to Social Blade, “We were notified of a potential data breach whereby an individual attempted to sell our user database on a hacker forum.” We checked the authenticity of the samples that were posted. It seems this individual utilized a weakness on our site to get to our information base.”

It continued: The information spilled incorporates no Visa data, however it incorporates different information that could be viewed as private data. Addresses were also included in a very small portion of the data, about one tenth of a percent. It was unclear whether these were digital or physical.

Even though hashes were accessed, Social Blade claims that users are safe because the company had never stored their passwords in plaintext. It likewise inferred it had distinguished the weakness and fixed it since becoming mindful of the break.

It said, “We’ve already addressed the method that this third-party employed to gain access to the system, and we’re doing additional reviews to ensure that the security of all of our systems is further hardened to prevent future incidents.” Additionally, it said, “Business users have been notified by email and their authentication tokens have been changed.”

It went on to say that, “Users who had connected their other social media accounts whereby an auth [sic] token was stored have been cycled as well as well where appropriate, ensuring that no connected accounts are at risk.” We sincerely apologise for the incident and are doing everything in our power to quickly resolve it and prevent future incidents.

Cybersecuritynest  is of the opinion that, based on a cursory analysis of the hacker’s breach notification, which was posted on December 12, the threat actor might have carried out the attack using a common attack method known as SQL injection; however, we were unable to definitively prove this at the time of writing.

The hacker, who asserts that they broke into Social Blade in September, added that they were only hoping to make a few sales before deleting the data-promoting thread. There was no price listed.