On December 17th, Mozilla was notified by a security researcher that a partial database of addons.mozilla.org user accounts was mistakenly left on a Mozilla public server. The database included 44,000 inactive Mozilla usernames and passwords using omd5-based password hashes, according to Mozilla. The company immediately erased all the md5-passwords, rendering the accounts disabled. All current addons.mozilla.org accounts use a more secure SHA-512 password hash with per-user salts. SHA-512 and per user salts has been the standard storage method of password hashes for all active users since April 9th, 2009.

" This issue posed minimal risk to users, however as a precaution we felt we should disclose this issue to people affected and err on the side of disclosure," Chris Lyon, Director of Mozilla's Infrastructure Security wrote in a blog post.

"It is important to note that current addons.mozilla.org users and accounts are not at risk, Lyon added. "Additionally, this incident did not impact any of Mozilla?s infrastructure. This information was also sent to impacted users by email on December 27th."