Alleged Snapchat hackers explain how and why they leaked data on 4.6 million accounts
The individual or team claiming responsibility for SnapchatDB has responded to The Verge's requests for comment the morning after the database went online, containing a leaked collection …
Context & Ripple Effects
The arc here runs through a broken disclosure chain: researchers say they flagged two Snapchat exploits first, and when those warnings went unanswered they published working code for matching usernames to phone numbers on December 25, 2013. Snapchat's response — new counter-measures announced around December 27 alongside a statement downplaying the technique as impractical — is now directly contradicted by events.
Overnight a group calling itself SnapchatDB put a database of roughly 4.6 million account records online, and this morning its members answered The Verge's questions about how and why. The pickup is unusually broad for a single-day story — Reuters, BBC, ZDNet, TNW and Troy Hunt all carried versions — which signals this has moved beyond a startup security incident into a mainstream privacy story about an app whose core promise is that data disappears.
First-order effects
- 4.6 million Snapchat users have their username paired with a phone number in public or near-public circulation, enabling targeted spam and phishing against accounts users believed were disposable.
- Snapchat's 'impractical' framing of the vulnerability is falsified by a live dataset, forcing the company to defend not just the hole but its earlier handling of the disclosures.
Second-order effects
- Every consumer app built on phone-number-based friend discovery faces the same question Snapchat dodged: whether partial rate-limiting counter-measures are enough when researchers are publishing proof-of-concept code.
- The episode pressures Snapchat's product roadmap — the company had just shipped an iOS update on December 20 adding replay limits and filters, and security remediation now competes with feature work for engineering attention.
Third-order effects
- If vendors keep ignoring private disclosures until code goes public, the norm shifts toward publication-first research, making pre-leak remediation the only real defense.
- An ephemeral-messaging service holding a durable, extractable map of identities exposes the gap between how apps market data handling and what their servers actually retain — a tension regulators and users are both positioned to probe.
The trend: Consumer app security is moving from quiet vendor-managed disclosure toward public proof-of-concept leaks, with companies like Snapchat judged as much on how fast they fix ignored warnings as on the bugs themselves.