Mitt Romney email and Dropbox accounts reportedly hacked

The Hotmail and Dropbox accounts of US Presidential candidate Mitt Romney appear to have been hacked in an echo of a similar break-in suffered by vice-presidential hopeful Sarah Palin in 2008.

So far there is no confirmation of the hack, first reported by a news site Gawker, but a statement made by Romney’s team offered credence to the possibility.

“The proper authorities are investigating this crime and we will have no further comment on it,” read an otherwise evasive statement made by Romney campaign communications director, Gail Gitcho.

Gawker said it had been contacted by an unnamed third-party who claimed to have broken into an old Hotmail mittromney@hotmail.com account supposedly not used after 2006 but now found to be active.

The hacker claimed to have bypassed security by correctly answering the security reset question ‘what is your favourite pet?’, which also turned out to be the password for Romney’s Dropbox account.

The email address accessed by the attacker came to his or her attention after the address was published in a story by the Wall Street Journal.

“I have nothing to do with Anonymous and have never done something like this before,” said the hacker.

What the hacker found in the accounts is not known and has not been leaked, unlike the contents of Sarah Palin’s gov.palin@yahoo.com account, the contents of which ended up on Wikileaks during her failed vice presidential campaign in 2008.

David Kernell, the 20 year-old son of Memphis Democratic state representative, Mike Kernell was later sent to a half-way house jail for the hack, losing his appeal against a charge of evidence deletion earlier this year.

Assuming the ‘hack’ actually happened and the email box contained sensitive content, the attack is still only mildly embarrassing as long as this remains unpublished. Romney was apparently still using an email address said to have been de-activated years ago and made the elementary mistake of using an easily-guessed password for Dropbox.

However, the attack underlines the potential susceptibility of some webmail services to relatively simple password reset attacks where two-factor authentication is not in use.