Cyber Incident Victim: Trakt
Date:
Dec 2014
Location:
United States of America
Summary
A TV and movie tracking service experienced unauthorized access to user data through a PHP exploit, discovered years after the incident. The breach compromised emails, usernames, encrypted passwords, names, and locations, but payment information remained secure due to separate storage. Following the discovery, the company notified affected users and prompted password resets, having since migrated to a more secure platform to prevent future exploits.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
In December 2014, an unauthorized party exploited a vulnerability in the PHP programming language to illegally access user data from Trakt, a California-based service for tracking viewed movies and TV shows. The breach remained undetected until 2019, when the company identified the incident and promptly notified affected users via email. Trakt disclosed that the attacker compromised information including email addresses, usernames, encrypted passwords, real names, and location data stored during the intrusion period. The company confirmed the exploit was limited to its legacy platform architecture active at the time of the attack. No evidence suggested ongoing unauthorized access beyond the 2014 event.
Trakt’s investigation determined that payment information remained unaffected due to its segregation from other user data storage systems. The company migrated to a new website platform in January 2015, eliminating the PHP vulnerability and implementing enhanced security measures. This migration ensured information entered after that date was not exposed in the breach. As a containment measure, Trakt initiated password resets for impacted accounts, directing users to a secure link provided in a follow-up notification email. The delayed discovery timeline—over four years between intrusion and identification—highlighted gaps in initial detection capabilities. User communications emphasized transparency about the historical incident while affirming current system security improvements post-platform migration.