The intruder was redirecting users that accessed article pages on reuters.com to a different landing page.

The breach was detected at approximately 7:25am, and fully-removed at 8am. There is no further suspicious activity across our network since, and the total duration of the event was 60 minutes.

While we use 2-step authentication, our initial investigation shows the attack was enabled through a phishing mechanism. We immediately changed all access passwords, and will continue to investigate this over the next 24 hours.

Please follow our blog and social channels for future updates, and for any question please email us at Tammy.g [at] Taboola [dot] com.

Thank you,

–Adam

Founder & CEO Taboola

Update from Lior Golan, Taboola’s CTO // June 23rd 
We wanted to share additional update.

The attacker used the fact a Taboola user, who had access to widget editing capabilities within our back-office dashboard (“Backstage”), used the same password for both email account and Backstage. This user fell victim to a targeted phishing attack, and provided their email password to the attacker. While we used two factor authentication for our email, we didn’t use such method for Backstage, and so the attacker was able to get in. The attacker then used Backstage widget editor (a tool that is exposed only to specific internal Taboola users) to edit the header of the Reuters widget. Taboola widget headers are comprised of an HTML snippet, and the attacker used this capability to add an HTML meta refresh tag that redirected users from Reuters to their own site whenever the Taboola widget was loaded there.

Within the first hour after the attack, we blocked access to the attacker on this account, pro-actively reset the password to all other Taboola Backstage accounts, and have fixed the specific widget that was compromised. As next steps, we are going to develop 2-factor authentication for privileged Backstage users, as well as remove the ability to enter HTML snippets for widget parts from the Backstage widget editor. We will consider a few additional precaution steps as we progress the analysis.

In addition, the attacker used the fact another Taboola user used a similar password to their email and to the Paypal account and was able to get into a Paypal account used by Taboola to pay small bills. That Payal account password was reset as well.

Is there a reason to be concerned about other publishers partners of Taboola? 
Since this single attack on June 22nd 7am EDT – 8am EST there was no suspicious activity registered. We are constantly monitoring our services for any additional suspicious activity or signs of compromise, and have installed several alerts that alert us on abnormal access patterns. We believe all Taboola and Taboola client accounts are currently safe.

–