A giant database of intercepted Snapchat photos and videos has been released by hackers who have been collecting the files for years. Shocked users of the notorious chat forum 4chan are referring to the hack as "The Snappening," noting that this is far bigger than the iCloud hacks that recently targeted celebrities.
Underground photo-trading chat rooms have been filled in recent weeks with hints that something big was coming. Thursday night it finally arrived: A third-party Snapchat client app has been collecting every single photo and video file sent through it for years, giving hackers access to a 13GB library of Snapchats that users thought had been deleted.
Users of 4chan have downloaded the files and are creating a searchable database that will allow people to search the stolen images by Snapchat username.
The database of Snapchat files posted online was hosted on viralpop.com, a fake competition website that installed malicious software on the computers of users trying to take part. That site has now been suspended and taken offline, although thousands of people have already downloaded the collection of Snapchat.
One news report suggests the hacked third-party Snapchat client was Snapsave. The popular Android app allowed users to keep Snapchat photos and videos, which automatically delete when viewed through the official Snapchat app.
In a statement to Engadget, Snapsave developer Georgie Casey denied his app was to blame, saying "Our app had nothing to do with it and we've never logged username/passwords." He also denied that Snapsave stores photos online. This means that the hacked Snapchat client was probably a website, rather than an app.
An anonymous photo trader contacted Business Insider to tell us that the site affected was SnapSaved.com. The service acted as a web client for the Snapchat app that allowed users to receive photos and videos, and save them online. What its users didn't realize was that the site was quietly collecting everything that passed through it, storing incriminating Snapchats on a web server, with the usernames of senders attached.
SnapSaved disappeared several months ago. Now the URL redirects to a Danish e-commerce site that sells set-top boxes and TV antennas. Most of the intercepted Snapchat photographs posted online featured overlaid messages in Danish.
We don't know if the third-party Snapchat client, whether Snapsave or SnapSaved, was created with the purpose of intercepting images. It may have been the case that hackers accessed the servers of one of the sites, which had inadvertently stored the files, and rehosted the directory online.
In a statement to Business Insider, Snapchat confirmed the images came from third-party sites, while denying that Snapchat's servers were breached by hackers:
We can confirm that Snapchat’s servers were never breached and were not the source of these leaks. Snapchatters were victimized by their use of third-party apps to send and receive Snaps, a practice that we expressly prohibit in our Terms of Use precisely because they compromise our users’ security. We vigilantly monitor the App Store and Google Play for illegal third-party apps and have succeeded in getting many of these removed.
4chan users say the collection of photos has a large amount of child pornography, including many videos sent between teenagers who believed the files would be immediately deleted after viewing. Half of Snapchat's users are teenagers between the ages of 13 and 17.
Snapchat has a poor history when it comes to the security of users' data. In 2013, security researchers revealed that it was possible to find the phone number of any Snapchat user through the app. The company was forced to apologize after 4.6 million usernames and phone numbers leaked online on New Year's Day. In February 2014, hackers used Snapchat to send photos of fruit smoothies to thousands of people.
