Q&A site Quora says data breach may affect 100 million users

Quora, a question-and-answer website founded eight years ago, says it suffered a security breach that compromised the data of as many as 100 million users.

The site, which lets its 300 million members and anonymous users ask and answer questions of each other, discovered Friday that "a malicious third party" gained "unauthorized access to one of our systems," Quora CEO and co-founder Adam D’Angelo said in a post on Quora.com.

The Mountain View, California-headquartered company contacted law enforcement and retained "a leading digital forensics and security team" to assist its internal investigation, he said.

Quora is contacting the 100 million users whose data may have been compromised and reset some users' passwords. The data potentially accessed includes names, email addresses and encrypted passwords, along with questions and answers posted.

"It is highly unlikely that this incident will result in identity theft, as we do not collect sensitive personal information like credit card or social security numbers," Quora said in a security update on its site.

While most of the content on Quora was public, "the compromise of account and other private information is serious," D'Angelo said.

More:USA TODAY's list of the biggest data breaches and hacks of all time

More:Several brands of dog food recalled over toxic levels of vitamin D, FDA says

More:Tumblr to ban all adult content beginning Dec. 17, and some users are fuming

More:Who's going to review your college applications – a committee or a computer?

User passwords were encrypted, but D'Angelo recommended users who reuse passwords on multiple sites to change their passwords.

The Quora breach comes just days after a massive breach reported by hotel operator Marriott in which as many as 500 million customers at its Starwood hotels may have had data including credit cards and passport numbers compromised.

About one-third of those online use the same three passwords, Gary Davis, the chief consumer security evangelist at anti-virus software maker McAfee, said in the wake of the Marriott breach.

"The scary reality is that even if hackers do not obtain payment information from a data breach, the customer is still at risk if they have used the same password to protect financial accounts, as hackers would be able to leverage this data to access financials," he said. "Therefore, we recommend proactively placing fraud alerts on credit files to ensure that any new or recent requests undergo scrutiny. This will protect consumers against the potential damage."

Many users had forgotten they had signed up for Quora over the years and were surprised to get an email Monday about the breach. "Nothing like a data breach to remind me that I have a Quora account," one user posted on Twitter.

Another user noted that the breach came soon after Quora began increasing the level of advertising on the platform "and here we are!"

D'Angelo said Quora believes it has "identified the root cause and taken steps to address the issue, although our investigation is ongoing."

He pledged the site would continue to make security improvements. "It is our responsibility to make sure things like this don’t happen, and we failed to meet that responsibility," he said. "We recognize that in order to maintain user trust, we need to work very hard to make sure this does not happen again."

More:Marriott says as many as 500 million Starwood guests' data may have been breached

More:Starwood data breach: Here's some ways to protect yourself

More:Dunkin' Donuts says some DD Perks members' accounts may have been hit by data breach

Follow USA TODAY reporter Mike Snider on Twitter: @MikeSnider.