Kickstarter 2014 Data Breach

The external breach record uses February 16, 2014. Kickstarter's security notice confirms the incident and affected field categories but does not disclose when the attacker first entered the system, so the catalogue date should not be read as the initial-access date. The company said it had no evidence that credit-card data was accessed and that, at the time of the notice, it had seen unauthorized activity on only two accounts. That limited statement does not mean no data was taken or rule out later misuse.

According to the company, older passwords were uniquely salted and repeatedly hashed with SHA-1, while newer passwords used bcrypt. These were not plaintext passwords, but they should not be treated as immune to offline guessing. Credit-card data is not retained as a structured class. Names are also omitted because the selected source set does not clearly list them as a general, verified field for this incident.

The completed production email-only import processed 5,169,669 valid lines and created 5,169,660 unique email associations in the live index. The local job did not import usernames, passwords, phone numbers, or mailing addresses, so local co-occurrence of those fields is not claimed. The external unique-email measure is 6,803 above the local associations. Dataset version, normalization, and deduplication differences have not been reconciled; no cause is assigned and the figures are not added together.

Kickstarter's current domain and incident notice remain available. An email match alone does not establish that a person created a project, backed a particular campaign, or had phone and address fields in the incident data. Anyone who may have reused the same password elsewhere should choose a unique password on that service and can use Kickstarter's current two-factor authentication and access-history features. Unexpected account or payment messages should be checked by navigating independently to the official domain rather than following the message's link.