The Gawker network security breach is shaping up to be quite serious. PBS has a report with more details on the kind of information that was exposed when hackers (possibly from 4chan) broke into the Gawker database: Gawker Data Breach Could Lead to Attacks on Government Agencies.

Gawker Media, one of the web’s largest publishers, has been hacked. The insides of the multiple websites within their portfolio, their 1.3 million user names, e-mail addresses and passwords, are now splayed all across the Internet for anyone to see. All the data was uploaded to the bit torrent file sharing network late Sunday afternoon, meaning anyone from Dallas to Dbruvnik to Djibouti can have a look.

The PBS NewsHour has learned that a select sub-list of what appear to be e-mail addresses and passwords of employees from federal, state and local government agencies were parsed separately for potential future attacks. They may have been used as part of Operation Payback, or another one of the initiatives launched by the so-called “Anonymous” cyber movement that has grown in scope since the release of secret documents by the web site WikiLeaks. …

The list appears to include a wide range of government agencies from King County in Washington State to mission controllers at NASA to a chief of staff for a member of Congress.

What follows are the instructions attached to the selected government addresses from inside an Anonymous chat room:

“These passwords are from an on going operation outside of (REDACTED) do not distribute outside of (REDACTED). Doing so will only jeopordize the serious lulz fest about to hit the internet in the coming months.

These people more than likely use the same pass everywhere. Try to gain access to the @email STMP using the email/pass combination also google their email address to find other accounts on the inernet they may have and try their password with said accounts.

If the people in this dump have admin/mod rights there maybe other sensitive information worth disclosing to the internet, scrape any and all information you can and dont be XXXXing stupid, these are government officials, use many layers of proxies and report back any lulz to (REDACTED).”

Do I need to remind anyone that if you had an account on any of the Gawker sites, you should immediately change your passwords? And if you used the same password on other sites, change it there too. (To something different this time.)

Here’s a page at Lifehacker, with information from Gawker about the hack: FAQ: Compromised Commenting Accounts on Gawker Media.

There’s a huge gaping hole in all of these stories though; not one of them contains the method that was used to gain access to Gawker’s servers. I would very much like to know more details about how this attack occurred — if it was a simple matter of an editor using an insecure password, or if some other technique was used.