Android is the most versatile mobile operating system in the market. Having used by many smartphone vendors, the operating system from Android packs tons of functionalities and features.
Among its many advantages, Android users can install apps from third-party stores very easily. And Aptoide has been one of the most popular third-party app store for Android in the market.
And here, it has suffered a huge data breach.
Under The Breach, which is a data breach monitoring service, uncover details about Aptoide data breach, and said that details of the store's 20 million Android users are leaked publicly on hacking forums.
The data includes “personal identifiable information” that include user’s email address, real name, sign-up data and IP address, device details, and also date of birth (if provided).
It also includes hashed passwords and some technical information, such as account status, sign-up tokens, developer tokens, if the account was a super admin, or referral origin.
Aptoide is a software "marketplace" application for installing Android mobile apps. Unlike the the official Android store, which is the Google Play Store, Aptoide provides a decentralized store, where users can manage their own store.
Headquartered in Portugal, Aptoide claimed to have 200 million users in 2017, and said that its app has been downloaded by about 6 billion times.
20 million of its users leaked may be a fraction of its total user base, but still, this leak was only a part of a larger breach that exposed data of 39 million users.
It was reported that the hacker has obtained them following a hack that took place earlier this April 2020.
Aptoide users who signed up to the app store between July 21, 2016 and January 28th, 2018, are the ones affected by this breach.
In a blog post, Apoited acknowledged the incident, saying that:
Our team is evaluating the threat and, if confirmed, taking measures to correct it. Meanwhile, we would like to rest you assure that all user passwords were encrypted.
Besides your email address used for login and encrypted password, no Aptoide user's personal data is in the database. Aptoide users were never requested for physical addresses, credit card information, telephone numbers, or other personal data.
Meanwhile, we closed the sign up at the Aptoide site until a full audit is conducted, and we have further information.
Soon, it will be required for you to introduce a new password for security measures. If your credentials in Aptoide are shared with other sites, it is a good policy for you to change it in the other sites as well.
We'll keep you updated through our Aptoide blog on developments on this matter.
