Kickstarter hacked, with data stolen for an unknown number of customers
Hackers breached Kickstarter's defenses and stole the information of an unspecified number of customers, the company disclosed today. The company learned of the breach on Wednesday from law enforcement officials …
Context & Ripple Effects
Kickstarter's disclosure lands two months after Target confirmed that hackers made off with encrypted debit PIN data in the holiday-season breach it confirmed in late December, keeping platform security at the top of the consumer-news cycle. The company learned of its own intrusion on Wednesday from law enforcement rather than through internal detection, then disclosed it the same week across its own blog and a broad syndication sweep that included the Guardian, Telegraph, CNET, Re/code, VentureBeat and The Next Web.
The stakes are higher than the user count suggests because of what Kickstarter had become by early 2014: a site whose record-breaking February funding seasons and arts funding rivaling the NEA pulled it into the mainstream, meaning its customer database now holds payment-adjacent identity data for a large backer base that mostly thinks of the site as an arts storefront, not a financial account.
First-order effects
- Kickstarter's customers face immediate exposure — the company has not said how many accounts were hit, so every backer must treat their credentials as compromised, and the disclosure-from-law-enforcement detail means the attackers may have had access before Kickstarter knew.
- Kickstarter's own communications team now owns the response: password resets, direct user notification, and explaining why detection came from outside rather than from its own monitoring.
Second-order effects
- Every other platform holding backer payment and identity data — competing crowdfunding sites chief among them — is pushed to re-examine whether it could detect a similar intrusion internally, since Kickstarter's breach was surfaced by police rather than its own systems.
- A stolen customer dataset of unknown size creates a ready-made phishing pool targeting people conditioned to click project updates, turning the breach into an attack surface that extends well beyond Kickstarter's own perimeter.
Third-order effects
- If breaches detected by law enforcement rather than the victim keep recurring, regulators and payment partners will face growing pressure to mandate detection and disclosure standards for platforms that hold consumer financial-adjacent data — the same pattern the Target breach put in front of retailers.
- Crowdfunding's growth beyond the arts means these platforms are quietly accumulating bank-grade identity data under arts-site security expectations, a gap that becomes structural unless the industry treats itself as part of the financial stack.
The trend: Consumer platforms are entering an era, opened by the Target breach, where data theft is disclosed after the fact and detected externally, forcing sites far beyond finance to operate under bank-style breach expectations.