Docker Hub hack exposed data of 190,000 users

April 27, 2019 TH Author

Image: Docker Inc.

Docker Hub, the official repository for Docker container images, has announced a security breach on late Friday night.

The breach came to light after the company started emailing customers about a security incident that took place a day earlier on April 25.

“On Thursday, April 25th, 2019, we discovered unauthorized access to a single Hub database storing a subset of non-financial user data,” said Kent Lamb, Director of Docker Support.

Docker says the hacker had access to this database only for a short moment, but data for approximately 190,000 users had been exposed. The company said this number is only five percent of Docker Hub’s entire userbase.

It is unclear if the hacker downloaded any user data from this Docker Hub server, but if he did, he may have gained access to Docker Hub user names, hashed passwords, and Github and Bitbucket tokens used for auto-building Docker container images.

Docker is now notifying users and prompting a password reset.

“For users with autobuilds that may have been impacted, we have revoked GitHub tokens and access keys, and ask that you reconnect to your repositories and check security logs to see if any unexpected actions have taken place,” Lamb said in the email the company sent customers.

The company is also asking users to review GitHub and Bitbucket account login logs for any unauthorized access from unknown IP addresses.

While only 190,000 seems a small breach, it is not. A vast majority of Docker Hub users are employees inside large companies, who may be using their accounts to auto-build containers that they then deploy in live production environments.

A user who fails to change his account password and may have their accounts autobuilds modified to include malware.

Docker said it is still investigating the incident and will share details when available. The security incident was not disclosed on the company’s website, but only via email. A copy of the full email is available here or in the image below.

More data breach coverage: