TIMERS: the server of the family album app Famm was accessed without authorization, and a user table of up to 1.43 million entries was pulled out, including up to 535,015 mail addresses and hashed passwords

1. 2020-10-09

   A table of users was pulled out of the app's server. [1] [2]

2. 2020-10-11

   A cloud provider warned of suspected unauthorized access. The company investigated but could not confirm that information had been taken. [1] [2]

3. 2020-11-16

   A user asked about security, and the company investigated again. It again found some unauthorized access but no sign that information had been taken out. [1] [2]

4. 2020-12-18

   After a concern was raised from outside, the company looked again and confirmed that information was pulled out on October 9 and how it was done. [1] [2]

5. 2020-12-23

   The company disclosed the case. [2]

The table covered up to 1.43 million users who had used the app by October 9, 2020, with only the fields they had filled in. It held up to 535,015 mail addresses and the same number of hashed passwords, up to 243,617 names, 185,073 display names, 235,970 birth dates and 102,763 icon image URLs, plus codes for gender and prefecture or country. [1] [2]

The company said it had found no unauthorized access to addresses and birthdays registered in the app or to images and videos saved in albums. [1]