Kickstarter sent password reset emails to millions of users, but didn’t tell anyone why – TechCrunch

Crowdfunding web site Kickstarter sparked fears in a single day of a potential safety incident after the corporate despatched unsolicited password reset emails to thousands and thousands of customers with out prior clarification.

The emails, seen by TechCrunch, tells customers that Kickstarter is “simplifying its login course of” and urges customers to “set a brand new password on your Kickstarter account.” The emails supplied no additional clarification as to why Kickstarter was asking customers to reset their credentials and there’s no point out of the mass password reset on Kickstarter’s web site or social feeds.

When reached Wednesday, Kickstarter spokesperson Kate Bernyk instructed TechCrunch that the corporate was not breached. Moderately, it was “selling customers to create a password in the event that they hadn’t already set one,” comparable to those that created an account utilizing their Fb login solely.

Bernyk stated 10% of customers, or about 5 million accounts, have been despatched password reset emails. Kickstarter at present has 50 million customers, the spokesperson confirmed.

A number of Kickstarter customers speculated that the password reset emails themselves, although professional, have been an try by attackers to steal their passwords. In any case, it’s lengthy been thought of cybersecurity finest follow to keep away from asking folks to click on on password-related hyperlinks in unsolicited emails, given it may be an indication that the account is compromised, and is a typical tactic utilized in phishing attacks.

Knowledge breach or not, maybe the suggestions Kickstarter acquired since sending these emails — together with cyber-savvy customers vowing to not click on on the “suspicious trying” emails — will see Kickstarter, and others, rethink this technique sooner or later.