This issue may affect subscribers on this list, especially those who have
edited Wikivoyage or the Wikimania wikis.

---------- Forwarded message ----------
From: "Erik Moeller" <>
Date: 03/10/2013 4:03 PM
Subject: [Wikimedia-l] [Wikimedia Announcements] Fwd: Notification about
Wikimedia user account security issue
To: <>


---------- Forwarded message ----------
From: Erik Moeller <>
Date: Wed, Oct 2, 2013 at 10:56 PM
Subject: Notification about Wikimedia user account security issue
To: Wikimedia Mailing List <>

See also:

On October 1, 2013, we learned about an implementation error that made
private user information (specifically, user email addresses, password
hashes, session tokens, and last login timestamp) for approximately
37,000 Wikimedia project users accessible to volunteers with access to
the Wikimedia "LabsDB" infrastructure.

LabsDB, launched in May 2013, is designed to give volunteers the
ability to write tools and generate reports that make use of data from
our databases in real-time. This supports bottom-up innovation by the
Wikimedia community. As part of this process, private data is
automatically redacted before volunteers are given access to the data.
Unfortunately, for some of Wikimedia’s wikis[1], the database triggers
used to redact private data failed to take effect due to a schema
incompatibility, and LabsDB users had access to private user data for
some user accounts in these specific wiki databases. As of October 1,
228 users have access to LabsDB, and the window of availability of
this data was May 29, 2013 to October 1, 2013.

This issue was discovered and reported by a trusted volunteer, and
access to the data in question was revoked within 15 minutes of the
report. We have no evidence to suggest that the private data in
question was exported in bulk or used for malicious purposes, but we
cannot definitively exclude the possibility. As a precautionary
measure, we have invalidated all affected user sessions, and are
requiring affected users to change their password on their next login.

We have also sent an email notification to affected users with a
confirmed email address.

We regret this mistake. LabsDB is still a new part of our
infrastructure, and we will fully audit the redaction process, so as
to minimize any risk of a future mistake of this nature.

Erik Moeller
Vice President of Engineering & Product Development

Contact information

Should you have any questions, please contact us via email to:

You can also reach the Wikimedia Foundation at:

Wikimedia Foundation, Inc.
149 New Montgomery Street
Floor 6
San Francisco, CA 94105
United States
Phone: +1-415-839-6885
Fax: +1-415-882-0495

[1] List of affected databases: aswikisource bewikisource dewikivoyage
elwikivoyage enwikivoyage eswikivoyage frwikivoyage guwikisource
hewikivoyage itwikivoyage kowikiversity lezwiki loginwiki minwiki
nlwikivoyage plwikivoyage ptwikivoyage rowikivoyage ruwikivoyage
sawikiquote slwikiversity svwikivoyage testwikidatawiki tyvwiki
ukwikivoyage vecwiktionary votewiki wikidatawiki wikimania2013wiki

Erik Möller
VP of Engineering and Product Development, Wikimedia Foundation

Erik Möller
VP of Engineering and Product Development, Wikimedia Foundation

Please note: all replies sent to this mailing list will be immediately
directed to Wikimedia-l, the public mailing list of the Wikimedia
community. For more information about Wikimedia-l:
WikimediaAnnounce-l mailing list
Wikimedia-l mailing list
Wikimediaau-l mailing list

Reply via email to