On May 21, 2014, the company revealed that the consumer database of usernames, passwords, phone numbers, and physical addresses had been breached between late February and early March. Users were advised to change their passwords; to expedite this, a "change password" feature was added to profiles of users who had not yet done so. The Syrian Electronic Army took responsibility for the attack.