There is recent outbreak news recently where Typeform’s Founder has sent an email to all users regarding data breach to their survey platform, Typeform 14 hours ago. Their discovered that an unknown third party has gained an access to their server and downloaded information including respondents provided in their survey form.
There is no Typeform Customers information leaked and it has been confirmed from their engineering team.
Here’s the data breach message from Typeform
Potentially compromised data breach on Typeform:
| Data type | Were you compromised? |
| Personal Account info | No |
| Results (answers from typeforms) | Yes |
| # of typeforms affected | 1 |
What do you mean by “compromised”?
In this case, “compromised” means that the attacker obtained access to your data and downloaded it from our servers. Unfortunately, this means that the attacker has partial data you collected prior to May 3rd.
How does this impact me?
All the responses you received prior to May 3rd from your respondents in the typeforms listed below are compromised.
What data was compromised?
The results accessed were from a partial backup dated May 3rd, 2018. As a result, all data collected since May 3rd 2018 are not compromised. Compromised typeforms are listed below.
What data is safe (i.e. not compromised by this incident)?
- Your subscription payment info is safe and secure (credit card, address, etc).
- Your typeform password is safe.
- The data you have collected since May 3rd is safe.
- If you collected payments via our Stripe integration, all of your audience’s payment details are safe.
What should I do about this?
If you received names and email data through any of your typeforms, you might want to let them know about the breach. They prepared a communication template which you can use as part of your communication strategy:
Dear [name],
We just received a message that Typeform had a data breach, which affected one (or more) of the typeforms we sent out. Typeform reports that an external attacker managed to get unauthorized access to respondent data and downloaded it.
The good news is that Typeform responded immediately and fixed the source of the breach to prevent any further intrusion.
If your name and email was downloaded by the attacker, then we recommend that you watch out for potential phishing scams, or spam emails. [If you collected payments via Typeform, you could add: Any credit card information you shared through Stripe is safe and secure.]
If you have any other questions, feel free to contact us.
Have their corrected the problem?
They have immediately initiated a comprehensive review of our system security and have identified the source of the breach and have addressed that security vulnerability. As a data collection company, maintaining the security and privacy of our customers’ data is our top priority. They will continue to take significant measures to prevent this type of situation from happening in the future, including a full-scale review of our security.
Could this happen again?
They are taking substantial measures to prevent this from happening again, including using a cross-functional team to review our system and the security measures their employ.
Why weren’t you been notified sooner?
Before notifying you it was important for us to feel comfortable that the vulnerability was resolved to prevent another attack. Since the attack they have been performing a comprehensive forensic investigation. They launched this communication as soon as possible after feeling comfortable that our platform is now secure.
Can you tell me exactly what data was compromised?
Yes. Please scroll down for the details.
Can I trust Typeform with my data going forward?
It is understandable that you might question the trust you put in Typeform. They would like to assure you that they have taken Data Security and Data Privacy very seriously, and they are doing everything their can to take actions that will rebuild the trust you placed in us.
They are taking security measures to prevent any possible future occurrence.
In the short term, they brought in forensic security experts who have helped us review the breach, and are helping us look into all other aspects where they can improve the security of our platform. Regarding this specific incident, we’ve identified the vulnerability and implemented measures to prevent this type of attack.
Going forward, they will continue to scale our security team to ensure everything to keep your data safe.
[UPDATE 2nd July 2018]
All affected Typeform’s User will have ability to download all of your compromised data. They were working over the weekend to create a secure solution to make it easier for affected users to download all their data that was compromised. This should help users to better assess if thry need to communicate this with any 3rd parties, and if so, which ones.
p/s: Did you use Typeform for your online survey marketing or campaign recently? Please let me know by contacting me here.
