An encryption flaw called the Heartbleed bug is already being called one of the biggest security threats the Internet has ever seen. The bug has affected many popular websites and services — ones you might use every day, like Gmail and Facebook — and could have quietly exposed your sensitive account information (such as passwords and credit card numbers) over the past two years.
Some Internet companies that were vulnerable to the bug have already updated their servers with a security patch to fix the issue. This means you’ll need to go in and change your passwords immediately for these sites. Even that is no guarantee that your information wasn’t already compromised, but there’s also no indication that hackers knew about the exploit before this week. The companies that are advising customers to change their passwords are doing so as a precautionary measure.
Although changing your password regularly is always good practice, if a site or service hasn’t yet patched the problem, your information will still be vulnerable.
Also, if you reused the same password on multiple sites, and one of those sites was vulnerable, you’ll need to change the password everywhere. It’s not a good idea to use the same password across multiple sites, anyway.
It was believed that SSL is secure and it will not leak your private information but while adding new functionalities for OpenSSL developer introduced a bug and due to that it is possible to access all your private information like your passwords. The bug was also not found by the preying eyes of code reviewers.
Major companies like Cisso, Synology, F5 Networks, Jupitor Networks etc hardware products also have been vulnerable to HeartBleed bug and they are releasing patches.