Thousands of Twitter accounts were compromised when hackers gained access to the servers of online gossip site Gawker Media.

Gawker said on Sunday its servers had been hacked and 1.3 million user account passwords were stolen. A group allied to the notorious image board 4Chan then published a file containing those details on a file-sharing site. This allowed spammers access to thousands of Twitter accounts where users had used the same passwords.

Gawker quickly published a statement on its website urging its users to change their password after its servers had been hit. While the stored passwords were encrypted, “simple ones may be vulnerable to a brute force attack”, it said. A group calling itself “Gnosis” subsequently released a 500MB file containing the data taken from Gawker on the file-sharing system Bittorrent.

The motivation for the attacks is not yet known. Hackers have previously targeted Gawker after articles were posted criticizing 4Chan. The attackers also took control of Gawker associated Twitter accounts to post messages supporting Wikileaks. Gawker has also published material critical of Wikileaks founder Julian Assange.

And it is not just Gawker’s Twitter accounts that have been hacked. Del Harvey, who heads Twitter’s trust and security team said a Spam attack on the site appeared to be related to the theft of Gawker’s account details. Hundreds of thousands of Twitter users had seen their accounts compromised and messages sent promoting an Acai Berry diet. “It’s all too common that people use the same password for multiple accounts,” Rik Ferguson, a security researcher at Trend Micro said.

Anybody that has had their Gawker account details published can expect to be targeted by other hackers, said Graham Cluley, a consultant at security firm Sophos. “Every identity thief, hacker and spammer out there will be attracted to that password file,” he said.

The impact would have been more damaging if compromised accounts had linked to sites containing bank-credential-stealing malware, he added. Users could protect themselves by implementing complex passwords for each online service that required a password, said Mr. Ferguson. Complex passwords can be made easy to remember, he said. He suggested taking a the first letters from the words in a phrase a user is likely to remember, such as “I wandered lonely as a cloud”. Some letters can be replaced by symbols, perhaps using “@” instead of “a”. Finally, adding the first and last letter of the website being visited to that phrase creates a unique but memorable password that is hard to guess, he adds.