A closer look at the leaked Snapchat data

[leeclemmer]

A new year, a new data leak.

Last Tuesday an anonymous group or person leaked about 4.6 million Snapchat usernames along with the associated phone numbers, save for the last two digits.  At SnapchatDB you can download the data in either SQL or CSV format.

The leak came about a week after Snapchat dismissed the threat - brought to their attention by Gibson Security - in a blogpost: "Theoretically, if someone were able to upload a huge set of phone numbers, like every number in an area code, or every possible number in the U.S., they could create a database of the results and match usernames to phone numbers that way. Over the past year we’ve implemented various safeguards to make it more difficult to do. We recently added additional counter-measures and continue to make improvements to combat spam and abuse." Apparently their counter-measures weren't enough.

Soon after the breach, the alleged hackers responded to requests for comment by The Verge: "Our motivation behind the release was to raise the public awareness around the issue, and also put public pressure on Snapchat to get this exploit fixed," they say. "Security matters as much as user experience does."

I decided to take a closer look at the data to see if there's anything we can learn.

First, I wanted to see what users have been effected. (To see if you are part of the leaked data, you can search for your name here.)  To do so, we can take a look at the area codes of the phone numbers.  As mentioned in various reports, the leaks only effect North American users.  You can find the list of North American phone numbers on Wikipedia: there are 323 American and 41 Canadian area codes.  After loading up the data in R, I split the telephone numbers and counted the area codes.  There are 76 in total, 2 from Canada and the rest from the US (attached).

Here are the top 10 area codes:

Area Code	Frequency	State
815	215,953	Illinois
909	215,855	California
818	205,544	California
951	200,008	California
310	196,183	California
847	195,925	Illinois
720	188,285	Colorado
323	168,565	California
347	166,374	New York
917	165,420	New York

Next I fired up SAP Lumira to take advantage of the great mapping features it has (you can get your free copy here).  Here's a choropleth map showing which states have been affected the most by the leak. If you live in a grey state, you're not part of the leak.  If you're in a green state, you may want to check to see if you're data has been compromised (you can check here).

The SnapchatDB data also comes marked up with regional information below the state level, which after looking into a bit I'm pretty confident is accurate for the most part.  Here are the top 10 regional locations affected by the leaks (attached):

Region	Frequency
New York City	334,445
Miami	222,321
Chicago Suburbs	215,953
Eastern Los Angeles	215,855
Los Angeles	209,888
San Fernando Valley	205,544
Southern California	200,008
Northern Chicago Suburbs	195,925
Denver-Boulder	188,285
Downtown Los Angeles	168,565

As this dataset is incomplete, we can only really draw conclusions about what users have been affected by this leak.  Some larger urban areas - like my Philadelphia - is fairly low on the list, but I wouldn't conclude that Snapchat is unpopular here, simply that it wasn't hit as hard.

Next I looked at the usernames, specifically the number of characters in usernames.  What we get is a nice, nearly normal distribution with a bit of right skew.  Looking at the data, I would guess that Snapchat requires a username of between 3 and 15 characters.  However, there are exactly 5 notable outliers (excluded in the histogram below), users for whom their email address has been published instead of their username (unless these 5 could choose to have their username be their email?).  I wonder how these 5 got to be included in this data set.

What other things might we be able to glean from this data?

Lastly, Gibson security has some good advice for those whose information has been compromised: you can delete your Snapchat account, change your phone number, and never give out your phone number if you don't have to.  The moral of the story is that even super-popular services getting billion dollar buyout offers aren't immune to user data leaks, so be sure you take your online privacy seriously.

If you liked this post, don't forget to hit the Like button at the top of the page: thanks!

You can find me on Twitter @leeclemmer.  I also occasionally post stuff at leeclemmer.com.