The parenting website Mumsnet has become one of the latest high-profile organisations to warn that users' data had been obtained by hackers exploiting the so-called Heartbleed bug, a vulnerability to the open-source code used by thousands of websites which became apparent last week.
The site, which has 1.5 million registered members, said it had no way of knowing who had been affected before the security hole was patched up and had decided to require all users who created passwords on or before Saturday to change them.
"The worst-case scenario is that the data of every Mumsnet-user account was accessed," Mumsnet said in a statement, which added that it had become aware of the bug on Thursday.
Canada's tax agency also said on Monday that the ID numbers of roughly 900 people were stolen from its systems as a result of the Heartbleed vulnerability. Among other systems confirmed to have been affected are Imgur, OKCupid, Eventbrite, and the FBI's website, all of which run affected versions of OpenSSL software.
Mumsnet's founder, Justine Roberts, told the BBC that it became apparent that user data was at risk when her own username and password were used to post a message online.
The statement issued on Monday by the website said that the bug allowed access to the information submitted via the login page, which included users' usernames, emails and Mumsnet passwords.
"It is possible that this information could have been used to log in as you give access to your posting history, your personal messages and your personal profile, although we should say that we have seen no evidence of that thus far," it said.
The Mumsnet statement added, however, that no site could give a cast-iron guarantee that data would be safe if users changed their passwords.
"We've installed the patch that fixes the known vulnerability in OpenSSL, and together with forcing a password reset, we think this makes MN [Mumsnet] users as safe as we can make them. But if there's one thing we've all learned from Heartbleed, it's that there may be security vulnerabilities out there that nobody knows about."
The statement went on: "To the best of our knowledge, so long as you have changed your password, the Heartbleed bug can no longer affect your personal data on Mumsnet. But of course, if you would like to close your Mumsnet account, you can do so any time."
