https://haveibeenpwned.com/ checks if your email (and passwords) have been on any public data leaks.

Edit: since this is getting some love, I'd like to recommend any password manager, such as passpack.com or lastpass.com to help generate strong passwords you don't need to remember and can be changed quickly. Also, yes, I've been pwned a number of times. Fucking adobe. 😕 If you have a smartphone and the site allows it, turn on two factor authentication too.

If you use the same password for other services I'd check https://haveibeenpwned.com . It is possible that your (hashed) password was leaked during a data breach and hackers could link your password to your username/email. If this is the case you should change your password on every service that uses that password.

EDIT: a word

also if you have a question please look if someone didn't ask it already. I'm getting a lot of messages :p

What I love is the companion to this site. https://haveibeenpwned.com/Passwords which finds out if your password has been leaked by asking you to give it your password. It is as secure as any other website asking for your website however. I just find the concept really strange.

Where I work, many of our users have gotten the same email. Enough so that we were able to adjust the filters to get rid of them.

Don't sweat it, don't click any links in the email, don't respond, and don't pay. They got nothing, and are just mass emailing using emails and passwords from various sites that were hacked.

You can also punch your email into https://haveibeenpwned.com to see what sites may have exposed your data, then change your passwords on there too.

Here’s couple of things everybody should do:

Use a password manager. This will solve tons of other problems for you, as you will automatically have a unique strong password on every site. I prefer password managers that do not store your passwords in the cloud, but keep them locally encrypted on your own devices and just use an encrypted sync to keep them updated on them.

Sign up for data leak notifications on Have I been pwned. This free service will email you right away if your email address is part of some data breach - such as the recent Yahoo breaches (or, say, Ashley Madison). The service is run by Troy Hunt and it’s trustworthy.

Use a good VPN to secure yourself while using wi-fi networks. Without a VPN, it’s trivial for anyone else using the same wi-fi to see big parts of your traffic. Use a VPN on your laptop, on your phone and your tablet. I like VPNs that enhance your privacy by also removing tracking cookies and other potential breaches of privacy. The added benefit of this is that browsing becomes much faster - it’s often faster with a VPN than without!

Lastly, make a backup. Then make a backup of your backup. Backup your laptop, backup your phone, backup your tablet. And back them up so that you can recover your data even if your house burns down. Because sometimes your house really does burn down, and sometimes you are hit by encrypting ransom trojans. Our lives and memories are on our devices and they deserve to be backup up.

Check your credit report for suspicious activity. It's something at least, but it won't exactly tell you if your information was stolen unless there's suspicious activity (I actually found a site that you can check at the bottom of comment)

I useCredit karma and it actually emailed me about my information that had gotten leaked and told me the name of the leak and what information has been compromised (passwords and CK tells you which ones, addresses, phone numbers, etc.)

I don't know if it's a thing they do instantly or is an option on their site though... They just emailed it to me one day

Googled around and got this but I don't know how legit it is... LEGIT https://haveibeenpwned.com/

Also this is a good one as well https://spycloud.com

Quick edit: tried it and it showed 5/6 times my info got leaked and it went over information about the breach, I'd give it a try

While I would have enjoyed the shadenfraude , it looks like this is just a case of email address they used being part of a large mass hack like LinkedIn, Sony, MySpace, etc. Not them directly being exploited. A non story if PWs are different everywhere and/or quickly changed. You can check yourself at sites like HTTPS://haveibeenpwned.com .

hacking really? yeah lets scare the shit out of people, and not clearly state that the reason access was possible is because:
"The man then recited a password Gregg had used for multiple websites."

AKA, guy had his email and password leaked from any of the major hacks from recent years.
Which he uses for everything including his nest account.
Always use 2 factor authentication, and different passwords for each account people.

Edit:
If anyone cares you can use https://haveibeenpwned.com/ to check if your email/password is out there on the internet for "hackers" to use and "hack" your accounts.
If you have been pwned and haven't changed your passwords in ages, then set aside some time to change every password for every account you have, and enable 2 factor authentication if it is available!

Do you intend to share data with https://haveibeenpwned.com/? The guy that operates that site never discloses lists of emails, but only allows people to check their known email addresses against the lists he has.

This is also why credential stuffing is such a problem. People use the same password everywhere, so one hack of a vulnerable site/service could expose all your logins at more important places (banks, utilities).

It’s relevant to this scam, because they could take a compromised password from a recent, innocuous hack, and then bluff that it’s your email password. For a lot of people, there’s a good chance that it is the same password.

Check https://haveibeenpwned.com/ and use a password manager.

Edit: added example

https://haveibeenpwned.com

Great website that lets you check if your data has been breached (by hackers) and released on the internet for everyone to see. All you have to do is enter your email. It's a safe site and is used by many across the world!

https://haveibeenpwned.com/

To check to see if your email has been in any of the recent breaches and future ones.

For the sysadmins out there, you can monitor your whole domain easily. We just got a notification a few days ago that several of our emails were in a recent breach

Please donate if you find this service useful! I know I have!

Edit: Few of your have asked what should you do if you are breached, most websites usually automatically reset everyone's password after its discovered. However a lot of people to do this day use the same password across the board (and people know this). Things you can do to help protect yourself:

• Different passwords on all websites
• Turn on 2FA on everything
• Look into getting a password manager

Even if the bank is informing the police it can't hurt to make a report yourself. Find the non emergency number for your local station at home and tell them what happened. Assuming the bank has security cameras it won't be hard for them to just pull up the recording from when the fraud occurred and hand it over to the police. As for your other personal info I'd go over all your accounts and update/change the security. If you aren't planning on taking a loan out in the next few months you could contact [email protected] to freeze your credit. Check out https://haveibeenpwned.com/ as well, it might give you a hint as to how your info got out there.

My information has been leaked in 6 separate hacks/leaks...

Literally all my information is available online somewhere, or on some person's hard drive

Froze my credit report awhile back, still though lol

Edit: https://haveibeenpwned.com/ and https://spycloud.com check if you've been pawned, I found it while writing another comment on this post so I put it here as well, it's important to check your shit

https://haveibeenpwned.com/Pastes You might want to read this page for a full explanation, but basically a paste is when someone actually spreads a text file with all the leaked information on pastebin or a similar site. The breach itself means actually obtaining the information, while a paste is a public spreading of the leaked info.

I think they check whether the password was leaked on HaveIbeenPwned.com and prevent you from using a password that has been. If it's a generic password (GitHub123!) then it needn't to be yours, but if it's tied to you, time to change your password everywhere you used it (even it wasn't yours, you should)

I got the same mail as you, several months ago. Laughed and ignored it, because that password hasn't been secure since several Sony hacks ago. https://haveibeenpwned.com has already been linked, I can confirm it's a good tool to use and register for.

Just make sure your email and banks/paypal use completely unique and strong passwords (keep reminders on paper, not electronically), and you're as secure as it's possible to be. That's the minimum, ideally you should do that for every service you actually care about.

I hope she's learned the wonderful lesson of not using the same password everywhere you go.

If you don't want the potential for the same thing happening to you, use something like https://www.lastpass.com/ and it can create a random hard to remember password for you, but store it in a vault so that you can summon it (and copy to clipboard) when needed.

I work in tech, see this shit all the time.

Also for another measure, go to https://haveibeenpwned.com/ and check if your account has already been a part of a data breach and update that password at the very least. The way a lot of hackers work is they'll buy a whole breach's worth of email/passwords, and because most people use the same password everywhere they'll just try to log into other websites with the same credentials.

More than likely you use the same e-mail/username and password combination on another site that has been compromised. You can check here:

https://haveibeenpwned.com/

If your account information has been compromised after you check it, I'd suggest using LastPass, make a master password no one would ever know and just use a random password generator to generate passwords for you. And of course activate 2FA on everything that has it, bank accounts, gaming sites, etc.

And of course, change your password if you've been pwned. Maybe run a Malware program to make sure you're not keylogged too and a virus scanner.

Google and Iphone both have features to wipe a phone if you're 100% sure it's lost if that ever happens to you or anyone else. You shouldn't have too much to worry about if your phone has a decent PIN, passphrase, secret swipe or fingerprint reader etc. Another thing I recommend is perhaps a HTTPS extension on whatever browser you use most. It'll prevent you from ever visiting HTTP sites (unsecure) if you set it up. It's 2018, there's no reason a website should not be using HTTPS. And if you go to websites that don't use it, be wary of any information you give out.

Good luck! I'm glad DE helped you.

For once I am not affected by a mass security breach. Phew.

As a side note, for other known mass security breaches in the past, y'all should take a look at https://haveibeenpwned.com

Edit: If you don't have two-factor-authentication activated for important services and websites/apps, it's a good time to do it.

Since we're on the topic, zomato suffered a data Breach in May 2017. I didn't get to know this until recently, don't remember this being in the news either. Passwords were compromised, I suggest y'all Check it too.

Use haveibeenpwned.com to check whether you've been pwned.

EDIT: Use a password manager. Use a VERY GOOD password for the password manager database. For reference.

Hi, Guy who does computer type stuff for a living here. There is nothing wrong with running a vpn and we set them up for clients all the time. But getting hacked by using public wifi is one of the very least common ways you will ever get compromised. It requires a higher degree of knowledge than many other methods, It requires someone to either be there or have been there physically which is extremely risky as these things go, and it targets an extremely small pool of people.

You are about a million times more likely to have your data compromised by someone overseas, most likely not from your computer but from some un-secured server. The number 1 easiest thing you can do to protect yourself is to use unique passwords for every site you visit online and set up alerts for yourself on https://haveibeenpwned.com/

Have you reused the email and password somewhere else? Has any place you might have used it been pwned? https://haveibeenpwned.com

Happened to me, still get an email saying someone changed my email and password on some service occasionally. Pain in the ass to keep everything secure. Two factor auth definitely helps, but obviously only before your account gets taken.

Unique strong passwords are the way to prevent this, a password manager is the easiest and most secure option.

I don't think he "hacked" your account. He definitely bought it off of some website, knowing it was stolen.

I suggest you check https://haveibeenpwned.com/ to see if a password of yours has been leaked in a data breach. That's how most people have their accounts stolen. That and using the same password for everything. When some random website they've used gets hacked, their one password gets leaked.

Plug your email into haveibeenpwned and see if it comes up with anything. It’ll check a whole bunch of dumps and leaks for your email and see if it has been involved in any sort of data breach

doubt it was twitch, scale would be much bigger. In your and other cases its probably other website where you had same login/mail which leaked your info - criminals scan top 100 websites hoping u had same password on other sites. You can check if you are in known leaks: https://haveibeenpwned.com/

btw i'd like to take this time to let people know that one of the biggest fake scams going around right now is an email from a hacker claiming that they have nude pictures or video of you from your webcam, and they'll release it unless you send them bitcoin. they even include a password you've used in the past so it seems real, but these passwords are from data breaches (e.g., dropbox, hautelook, marriott... there have been a lot). you can see if your data is on the dark web by using haveibeenpwned.com to check your email. it'll tell you what exactly was stolen during which particular data breach, pretty neat.

but do not fall for this shit if you get an email that says that. just ignore it and mark as spam and delete. i got one and had a moment of panic before quickly realizing it was an old password and i'm only ever naked in front of my laptop if i've been too lazy to put a shirt on and am double-chinning it while eating.

> decided to let Safari pick it

Using a password manager is good, but make sure you have access to your AppleID password independently of Keychain. Either remember it, or write it down somewhere secure. You never want to end up in a situation where you're trying to setup a device, but don't have Keychain accessible to pre-fill it for you.

Also, check your old password here. That will let you know if your password has been seen in known public security breaches. https://haveibeenpwned.com/Passwords

It’s entirely possible that OP recycled passwords and used the same or similar password + the same email account on a different, already compromised site. I would recommend everyone to check https://haveibeenpwned.com and change passwords if you recycle them.

This is kinda old news.

Site to check if your email/password combo has been compromised: https://haveibeenpwned.com/

For Kickstarter specifically:

> In February 2014, the crowdfunding platform Kickstarter announced they'd suffered a data breach. The breach contained almost 5.2 million unique email addresses, usernames and salted SHA1 hashes of passwords.

> Compromised data: Email addresses, Passwords

hmm weird, the actual data shows about a 10% difference not 19%. http://imgur.com/a/ZV5vu .

Most cases of identity theft arent targetted either. Just people buying bulk collections of leaked personal data and seeing if people have re-used the password for other sites. Remind people to periodically check their emails on https://haveibeenpwned.com/ and tell them they shouldn't reuse passwords that have been leaked.

It’s actually quite awesome. They’re using one of the leaked password databases to see if you’re using one that has been used before. 1Password now anonymously checks passwords against this database. I hope more websites use this method.

Here’s a big list of leaked passwords: https://haveibeenpwned.com/Passwords

(FYI - they’re using a method that checks the hash of your password against the list’s hashes. That way your actual password is never sent to any third party and could never be reversed.)

It’s fake, but you should change your passwords. These are opportunistic mildly tech-savvy dudes that got your password from a security breach. If you wanna look into your privacy, check this out: passwords and e-mails. Enter your password or e-mail (depends on which tool you use, but it’s pretty straightforward) and it’ll tell you if your password has been breached. Cheers.

To everyone saying "lol no way suckers!", Two points:

1. Good! You should be skeptical. Ask questions. Take privacy and security seriously. However...

2. In this case, you need not worry. I encourage you to research for yourselves and make your own decision, however the creator of the site is well-known in the security community and actually has several projects like this related to infosec, as well as a ton of authored content: https://haveibeenpwned.com/About

And from https://haveibeenpwned.com/Privacy : "Searching for an email address only ever retrieves the address from storage then returns it in the response, the searched address is never explicitly stored anywhere"

Time to change banks to one that requires your card and pin entry to withdrawal money from a teller.

I would also strongly suggest that you lock your credit and request a copy of your credit report to look for fraudulent activities.

Request a copy of the withdrawal slip from Citibank so you can compare the signatures. If they are even remotely similar change the way you sign things.

It is probably a good idea to also check repositories like have I been pwned to see if your details have leaked from a hack somewhere. This is another good way to check for identity theft.

If your identity has been stolen, you're in for a bad time for the rest of your life.

To check if your email is at risk:

https://haveibeenpwned.com/

Straight up, if your email is flagged on here you need to immediately reset your Epic password and email password to something unique (from each other) and difficult. I would even recommending switching to a different email that is not compromised. Obviously, use 2FA as well.

Seriously, this is an easy check and will save you a huge headache.

I signed up for a website recently that checked my password against https://haveibeenpwned.com/ and warned me that my password has been compromised (which in my case was fine since it was a throwaway account.) I'm surprised this isn't a thing on more sites.

The account system powering Epic Games store and Fortnite have not been compromised.

Specific individual accounts have been compromised as a result of numerous automated attempts by hackers to try to log in to Epic Games accounts using email/password combinations leaked through security breaches on other web sites.

Epic accounts that use the same email address and password as a compromised site are vulnerable to this attack.

Always use a unique password for every web site. Additionally multi-factor authentication should be used to add an additional layer of protection.

Epic accounts that use the same email address, but a different password, are not vulnerable to attack, but may receive an email notification when such logins attempts are made.

The https://haveibeenpwned.com/ site will tell you if your email is in any of the leaked account databases commonly used by hackers. If you have an Epic account, and your email is on this list, you’ve likely received these failed-login-attempt emails in the past.

We have an automated system processing email/password dumps that proactively forces password resets on login, further protecting players. Credentials matching the pastebin from this post will experience a forced password reset on their next login.

This. Definitely change passwords. Use Uppercase and numbers for a safer password, as well.

Check https://haveibeenpwned.com/ and check if your password was part of a bigger leak. If so, change it everywhere you used it.

Setup 2FA on your accounts ffs

Edit: you may also want to set up an alert with HIBP, I would put money on your computer being fine but your credentials having been compromised from another site.

Breathe. No matter what anyone does to your account, they won't compromise anet's backup information. You might find your account state rolled back a bit, but there's a pretty good chance they'll be able to recover your everything. Your main goal is to collect yourself and prevent any bleed-over.

In the meantime, secure your other accounts.

• Run a virus scan. It's unlikely you have a keylogger, but do it just in case
• Lock down your email(s) disconnect any other sessions if your service has that option, set a new password, and enable two factor authentication.
• Do you save passwords in your browser? Try not to. Go through every password you have there and change it in order of importance, Make each password new, not guessable, unique, and long. Don't take any shortcuts like using the same core password with slightly different capitalization or different digits at the end.
• If you don't save passwords in your browser, do the above step anyway.
• If you have trouble keeping up with all those password changes, consider a password manager like lastpass.
• Pay special attention to any place where you used the same password as you do for GW2. Really, make sure you're not reusing your passwords anywhere. A lot of breaches happen because your information is compromised on one site and they try the same combination on a bunch of other sites.
• It may also help to look at Have I been Pwned to see if there are any particular things you need to pay special attention to.
• Two factor authenticate anything important. Keep a look out for other breaches in the future.
• if you use public internet a lot, consider signing up for a vpn?

It's okay. You'll be fine. This is incredibly stressful, but you can recover from it without any long-lasting life impacts. If you make these changes now and keep up with them, you probably won't have to worry about anything like this for a long time.

I would recommend using 2fa for your accts (if you haven't already done so) to also be on the safe side after the password changes. I know it's a large cleanup but definitely worth it imho. Also consider using Troy Hunt's https://haveibeenpwned.com to track whether your info has been in data breaches.

Good luck!

It might not be Tidal just your everyday password dump. Some site got breached and your info got sold. Check out https://haveibeenpwned.com/ to see what breaches it was and get yourself a password manager and give every account a unique password.

https://haveibeenpwned.com/ lets you check your usernames to see if they're in any lists of hacked emails/passwords/usernames.

I actually found out that I had two passwords that were not secure, which did kinda freak me out. I check it regularly now.

Query your E-mail with: https://haveibeenpwned.com/

That should allow you to ascertain if there has been any breaches.

Otherwise, it's possible that your credentials may have been stolen some way or the other.

That location may not be 'precise' - because it's simply an approximation in many cases.

Nah this is a false positive, i've seen one earlier on. Possibly a technical issue with them forcing the new 2fa out to all accounts before they can stream. i think it's possibly just a knock on effect.

​

check your password on https://haveibeenpwned.com/ to see if it has been listed on known sold password databases etc,

​

No password is secure 100%

​

If there was a breach Twitch would have to declare it by law the moment it is discovered.

I checked https://haveibeenpwned.com/ and it said 4 data leaks. I have only heard of one of the four offenders (linkedin). With respect to the other three, how did they get the info in the first place? Did they buy it? Some behind the scenes entity?

Apollo, Discus, and Exactis are the other three.

Considering that multiple accounts were breached, chances are Boogie was using the same password for multiple accounts, and the """"hacker"""" just bought a hacked db from a forum on the dark web and just logged straight in.

You can use https://haveibeenpwned.com/ to check if any of your accounts on any site has been breached in the past.

>Ravioli ravioli I want to bang a futa loli

Nice twitter description, although you're probably kidding ;)

​

But really, how easy you are to track down through the internet really depends on how much information about yourself you put online. Youtube tells me you're somewhere in the states, assuming you were honest on that. Which country you're from does narrow it down a bit (but not that much,) but I'm not about to start looking *that* hard.

​

You probably have nothing to worry about. Other people posting here might though (because fuck scientology; come at me Tom Cruise ,ya five foot fuck nugget)

​

I'd also recommend seeing how badly you have been pwned to get an idea as to how much information of yours might be out there and in what form.

> (MD5 is an encryption algorithm we used to encrypt your data). This means your old passwords were secured and not directly accessible by anyone.

How is this guy even working in IT?

Edit: Have I been Pwned claims it was salted SHA1.(source)

xkcd-style passwords are a good start, but they're still vulnerable. There's a tool from Dropbox, <code>zxcvbn</code>, which allows you to estimate how secure your password is based on a number of factors (length, simplicity, dictionary words, common passwords, etc.). For example, my old password on reddit was an xkcd-style password which could be guessed in 36 minutes at best. Adding a bit of complexity to such a password makes a huge difference: a couple punctuation marks, a random number in the middle of a word, etc.

Also, haveibeenpwned.com is a must-have tool for making sure your password hasn't been published in any dumps, making checking across dozens of sites really easy. LinkedIn recently suffered a major breach and they didn't notify their users for hours, but this site caught on quickly.

Well, to be fair, around 2,330,380 Patreon accounts leaked last October. Data compromised: Email addresses, Payment histories, Private messages, Website activity.

Check if you're affected by the leak: https://haveibeenpwned.com/

It has and it's just a part of my life now. I've gone through identity theft multiple times. My credit score is absolute crap because of it. I've fought to have things removed from my score for years, submitting reports and findings across all agencies multiple times. Some things are permanent on my credit score and no matter what I do, they can't remove it. Because of these things, I'll never have a score above 700. Trust me, I've gone through all the steps. Every process. Every subreddit for help. Every agency for assistance. I've sent countless reports and requests to Equifax, Experian, and TransUnion. I've received multiple letters from my information being stolen from multiple places. I've had over 30 bank/credit accounts opened in my name by people other than myself. At one point, I owed almost half a million (~$450k) to accounts I never opened or used. I still "owe" ~$30,000 to some random company in Washington (a state I have never lived in). The $30k has been on my credit report for 8+ years now. I try to have it removed twice a year by sending removal requests to each agency. None of them have been able to remove it and the company says they don't have it on file anymore. In essence, I owe $30k to no one and it's hurting my credit score. This is just my life now. My accounts have been "frozen" for years.

According to sites such as "https://haveibeenpwned.com/", I've been "pwned" 26 times.

Have I Been Pwned? is owned and operated by Troy Hunt, a storied information security consultant. He’s recognized by Microsoft as a Most Valuable Professional and was called to speak before the US House Committee on Energy and Commerce about infosec.

HIBP is sponsored by 1Password, a leading password manager app, as well as the networking company Cloudflare. It’s also served over HTTPS.

You’ve got every reason to be skeptical, but it’s a pretty reputable and useful website recognized by security experts all over.

Paljonkohan tällä mahtaavat tienata? Itsellenikin pari tullut, yleensä aina jonkun isomman käyttäjätietovuodon jälkeen (Suosittelen rekistetöimään sähköpostin tuonne: tulee ilmotus kun se osote löytyy jostakin tieto dumpista)

The only culpability for GGG here is that they haven't implemented 2FA for their sign in. GGG should not be in the business of keeping your credentials safe from attacks that are external to GGG.

The "hack" is all on you and boils down to you either sharing your password amongst multiple devices and one of them got compromised, or you having installed some virus along the way that has a key logger. These days it's more likely that you have used the same or very similar password on another service that has been compromised. You can check by searching https://haveibeenpwned.com

Same here. It's also stupid because my credentials for this email have been breached 8 times on other sites, but my reddit password is secure. You can check for your e-mail on haveibeenpwned.com and if you were on the internet for a long time, you can be sure that it did. Adobe, Funimation and a freaking pokemon forum got breached with my credentials leaked.

I thought reddit got hacked because resetting your password due to a random site being breached is just stupid...

They generate spam emails based on large data breeches. You can see for yourself here: https://haveibeenpwned.com/ (it's safe to add email here).

&#x200B;

Just change your password if it hasn't already been changed. Usually after the data breech you would have been forced to pick a new password anyway.

https://haveibeenpwned.com will check if your data has been included in any stolen databases. They will also let you know each time it happens again. I’ve had my data stolen a few times (adobe, Dropbox and something else), however you often don’t know until years after the breach happens.

Saw this earlier. You can download the 7z archive here: https://haveibeenpwned.com/Passwords

The passwords are stored as SHA1 hashes so they can't just be used for bruteforcing. Instead, it's meant for website owners to hash a user-entered password and see whether it has been Pwned at some point and prevent them from continuing.

This. I recommend putting your email into HaveIBeenPwned (shitty name, great site). It tells you if your email was found in any large data breaches/text dumps. You can also enter a password to see if that appears anywhere as well.

A guy logged on my TeamViewer account and remoted into my PC to PayPal himself $400. Lucky I was able to get it refunded even though it came from my IP address (because it was apparently sent to a sketchy place in Africa).

I’ve had to do it once or twice. Check your old password on https://haveibeenpwned.com, large companies now monitor breach dumps and if they find your password in the list, force a password change. If your pass has been breached, make sure you change it everywhere you might have used it because it’s no longer safe.

They have one of your passwords from the many hack and dumps from Adobe, LinkedIn, etc. Go to https://haveibeenpwned.com and put in your email addresses. It will tell you if your password was leaked.

As an aside, I recommend everyone check out https://haveibeenpwned.com/ at least a couple of times a year. It gives you full details of all the sites that have been compromised with your email address/details stored on it. You can also register your email to be alerted immediately when it is breached.

Use a dedicated password locker like Last Pass and generate unique secure passwords with at least 40 random characters on every site you use. This will prevent leaks from doing as much damage, since they will only have the password for the site in question and nothing else.

If your credit card details are leaked, ring up your card company immediately to explain the situation and ask for a new one. You should be protected from unauthorised purchases.

Hi bud. Mr Peligro here, Security Analyst on EVE. These threads are always sad to see.

The Account Security queue is heavy right now, with over 300 poor lost souls in it. Realistically there will be some waiting involved. CCP wants to get you back in the game ASASP, and with your account in a usable state.

Sadly this issue of credential stuffing is systemic across the internet. Bad guys continue to have success with this method.

What CCP sees is that there are periodic bursts of botnets used to try credential combinations obtained from various sources, to see what sticks.

I don't mean there is a person trying random usernames and passwords; these are rather distributed attacks. I'm sure there is a name for it, I'll call it trawling the internet...

I'd sign up for breach alerts here: https://haveibeenpwned.com/ - Troy is a trusted gentleman in the InfoSec business and CCP is actually using his awesome API to try and spot these breaches as they happen.

&#x200B;

Finally I'll say these guys are financially motivated. They are only doing this because there is money to be made in stealing your stuff. Don't do RMT because there's little way of knowing where what you are getting really came from.

Lately, know that it's mostly from people who have been pwned. :(

En Microsoft kille driver nedan sajt där man kan kolla om din konto/lösenord har varit lagt ut på internet pga nån företags data breach. Tyvärr verkar det mer sannolikt nuförtiden att ens lösenord hamnar på nån lista som säljs mellan hackare eller bara publiceras gratis på nätet.

https://haveibeenpwned.com/

If you sign up for everything with the same password, all it takes it one of those hundred websites to get hacked and you're boned. If you signed up for MyPokemonFantasy.com in 2003 and it turned out they didn't have good security on your password, when they get pwned you lose all security on all accounts ever. Have I Been Pwned illustrates this concept. My long time personal email address has been involved with 19 different password breaches, for example.

However, if you have used a password manager, then MyPokemonFantasy.com would have a different password from your bank and every other website. So if it gets pwned, only that one account is lost.

This all hinges on the password manager not getting pwned, of course. Which is why you should be very serious about choosing one that you believe won't ever have any serious security issues and why you are accepting complete trust in them to all your accounts.

One upside though is if a popular password manager got hacked, word would get out quick. It would hit the news as soon as accounts that were protected by one of them were getting cracked open. So you'd have some warning and if you weren't one of the unlucky early people to get your stuff nicked, you could go and fix it.

Everyone should take the time and get a password manager. They are trivial to set up and will save you a lot of headaches.

People don't get "hacked." Your password was not brute forced. What most likely happened is that you used the same username/password combo on some other shithole website and it got compromised and they stored their passwords in cleartext.

The hacker then uses the credentials on every site worth a damn and sees if they score a hit.

Stop reusing passwords. Every site should have a unique password. This is hard. So use a password manager.

2FA also solves this problem but it is hard to make mandatory so businesses are slow to adopt. FIDO U2F Yubikeys are THE BEST idea but only websites work with them now. TOTP like with Google Authenticator are better. Text messages are the worst (because of SIM swapping) but better than nothing.

Ideally you want unique passwords AND a hardware 2FA. This severely reduces the chances of attack.

The tools to protect ourselves are out there but companies and businesses are not helping by not adopting them. Be loud. Our wizards account NEED 2FA.

EDIT: Oh and yeah my national bank account didn't have 2FA until a couple of years ago. That's how fucking behind all companies are. Tech companies are up to date but the rest treat us like shit.

EDIT: https://haveibeenpwned.com/

Apparently on EBAY people sell "Legit FN STW accounts" for PS4. And you guessed it. No codes whatsoever.

You get an account email and password that already has STW PC on it and all you have to is link up your PSN account to it orany other platform of choice. And they sell cheap too, from 9$ and upwards.

I almost fell into buying one of these looking for a cheaper alternative. But i figured out it was cracked accounts when the guy ( seller ) sent me emails that didnt work and sent other emails and they all seemed like theyre real emails of other guys.

So my advice to you. Youve probably been cracked.

1) Never use the exact same passwords everywhere, try having unique passwords for everything.

2) Try to have a junk email address for signing up on forums or any non popular website.

3) Enable 2 Step Verification on everything you have. Preferably Google Authenticator or using a cell phone.

4) Use a password manager like LastPass or smth else as they can generate and keep secured passwords for your accounts routinely.

5) Change your passwords everywhere you care for as you are probably vulnerable now.

6) NEVER keep your credit card info linked. Havent you heard of the Sony disaster? I guarantee you itll be used if ever stolen.

7) Check this website called Have I Been PWNED routinely to check if your data has ever been leaked from a weak and unsecure website breach youve signed up at.

> I have absolutely no clue how they got hold of my account, but it's fair to say that if you have any accounts that you haven't checked in a while, they might have been taken, or be on their radar.

You probably used the same login on another site which got breached, check https://haveibeenpwned.com/

> Probably used a password twice and the service I used it on got hacked...

This site might give you some clues.

https://haveibeenpwned.com/

This is why it's so important to not share passwords between sites and use a password manager.

Heh, that is... unlikely to happen. Also, I am but a humble GM. BUT: Tell your friends. The bulk of these guys were using hacked player accounts. :(

• Make sure you change your passwords now and again

• Make sure you NEVER REUSE OLD PASSWORDS

• Make extra sure you DO NOT SHARE PASSWORDS across SERVICES

GW no longer has account restoration tools, so when these guys get their paws on your accounts, they are likely to wreck them. Chances are that your email and password may have been known to hackers for a long time due to compromised sites. https://haveibeenpwned.com can help you check if your email is known. If it IS, the CS team can help you if you wish to change your account email to a new, not before used one. Just remember we do need to verify your account ownership status, meaning your entered postal address, your serial codes and so forth.

Bitwarden will hash the password. This creates a fixed length of 256 characters every time. Bitwarden takes the first 5 of them and sends them to the haveibeenpwned servers and that server reports back all hashes that start with those 5 characters. Those set of hashes are sent back to your Bitwarden where they're compared. If one matches in full the hash of your password then its safe to assume your password has been in a breach.

The comparing happens at your computer and your full length of password is never sent over, only the first 5 characters to narrow it down.

Your password should be considered compromised if you reuse it. Check https://haveibeenpwned.com to see if you're in any known breaches.

Use something like Lastpass or 1password or another password manager that will let you easily generate random passwords and use them across devices and computers. I know with Lastpass you can have it check your password list for any reuse and you can go change those.

Run your email through https://haveibeenpwned.com/

Since you share your passwords across sites, when someone gets access to your account info on one site they can then access it everywhere else you've used that password. Lists of email/password combinations are circulated widely and used by spambots to hijack accounts that are otherwise in good standing.

If your email account uses the same password as any of the sites you've been compromised on, it's also possible they did a password recovery on OKC and just deleted the email. This is why, if nothing else, it's vital to use a unique password for your email account.

Imgur wasn't contacted by the hackers. A security researcher discovered the breach and notified imgur.

If you look at https://haveibeenpwned.com/ one thing they track is user information that has been discovered after being posted to public sites. So I'm guessing the imgur breach was discovered after its decrypted user database was posted.

That wasn't a brute force, they knew your login details and they knew it worked because it asked for the 2FA code. Your passwords are in breaches and they're trying them on any service that will let them in. You need to change passwords on other accounts that used the same password. Check out https://haveibeenpwned.com/ to see what breaches you're in.

In addition to a stellar track record, they are also extremely quick in adding new security features to the app. The website haveibeenpwned added a feature where you could check if your passwords are already logged in a gigantic database of hacked accounts and the 1Password team added this check to their Watchtower within 24 hours

To everyone who sees this out there, seriously consider doing the following:

• Enable 2FA (Two Factor Authentication). This is an extra security step that will prevent people who know your password from logging in.

• Register your email with https://haveibeenpwned.com/ They will notify you if an account associated with your email has been hacked.

If you think "I don't need this, who would target me?", remember that these attacks are not targeted. They are often blanket, lowest-hanging fruit attacks, which probably includes you if you don't take any precautions.

Edit: If you don't believe me, CTRL + F for "Epic Games" https://haveibeenpwned.com/PwnedWebsites

You may want to check your email with https://haveibeenpwned.com/

It could be possible they got your password from someone else's hack. If you find a hacked account there with the password given, then chances are they've just downloaded a password dump, and none of the above happened.

The domain 'capitaloneemail.com' is registered to Capital One Services, Inc.; P.O. Box 85565, Richmond, VA, 23285. The registrant is , and the tech email is .

All of that looks above board. I work in email marketing, and the body content of the email also looks pretty legit and on the level to me. If you're in gmail and click the drop-down arrow by the message and click 'show original', do the headers indicate SPF PASS and DKIM PASS with domain capitaloneemail.com ?

This sort of looks legit to me. Sounds like they might not have been breached themselves, but they found your username/password combination in the dataset from some other company's breach and suspect someone used those credentials to login to your capital one online account. You can enter the email address you have tied to your capital one account here to see if that email was compromised in any of the major data breaches of the past few years: https://haveibeenpwned.com/

This is interesting, because I very recently had an issue with hundreds and hundreds of contacts being added to my account. And there's no way to delete contacts in bulk.

I actually already assumed my TV account had been hacked and have since changed the password. I contacted TeamViewer to see if they could remove the contacts for me, and instead got a canned response.

For the record, https://haveibeenpwned.com does in fact show that my email address has the big Adobe and LinkedIn data breaches listed, so that's what I assumed it was. But now I'm not so sure...

Change any passwords associated with anything that shows up on https://haveibeenpwned.com/

And then stop pretending that internet is anonymous if you haven't taken any precautions to make it so.

The mere fact that people can find you is no big deal - there were already a fuckton of people who could find you without internet. Like all your government's agencies and anyone friends with anyone there (or willing to pay them enough).

You can never know for sure. Shit, we could all be living in a simulation for all I know. However, by reading the about page and having a look at his social media and other profiles you can determine whether the person running the site seems trustworthy.

>Who is behind Have I Been Pwned (HIBP)

>I'm Troy Hunt, a Microsoft Regional Director and Most Valuable Professional awardee for Developer Security, blogger at troyhunt.com, international speaker on web security and the author of many top-rating security courses for web developers on Pluralsight.

I mean, I guess he could be playing the ultimate long game just so he can collect some email addresses. But in that case I say GG, this guy has really earned my email address.

LinkedIn In May 2016, LinkedIn had 164 million email addresses and passwords exposed. Originally hacked in 2012, the data remained out of sight until being offered for sale on a dark market site 4 years later. The passwords in the breach were stored as SHA1 hashes without salt, the vast majority of which were quickly cracked in the days following the release of the data.

Breach date: 5 May 2012 Date added to HIBP: 21 May 2016 Compromised accounts: 164,611,595 Compromised data: Email addresses, Passwords

https://haveibeenpwned.com/

lol search up your email on https://haveibeenpwned.com/ or something similar, your email was probably included in a leaked database and people are trying to get into your account and then sell it on "the forum" for ez money.

EDIT: Unreal Engine did have a breach a while ago, but that was long before fortnite's popularity.

Nuo VOIP-puhelinhuijareita ei näin Suomen ulkopuolisina toimijoina voisi vähempää kiinnostaa luovutuskiellot, lisäksi nuo puhelinnumerot ovat hyvin todennäköisesti jostain sadoista internetin tietovuodoista.

No need to guess. You can check for yourself if your email address appears in any major breaches here. It's one thing to know that your credentials may have been leaked. It's quite another to actually see the five specific leakes that they ended up in.

As a side note, I'd like to point out that the proper way to store passwords is actually with a dedicated password storage algorithm (generally called a KDF or a "slow, salted hash"), not encryption. If they're stored using a proper algorithm (Sugh as bCrypt it Argon2), the trick of looking for the same passwords won't work, along with a long list of other attacks that target improper password storage methods.

Unfortunately a large number of developers think they can do better than the state-of-the-art and roll their own "encryption" scheme. The end result is how most passwords end up getting cracked so easily.

You can check if you have at https://haveibeenpwned.com it is a sit built by a cyber security expert. If your data is available online it will show who leaked the information and what information was leaked during the hack.

If someone gets your password somehow, they can access your account if you don't have two factor authentication. If you reuse passwords on multiple domains, you're at increased risk of someone getting your password and using it to access other sites you use. You can check if any of your email addresses were in public dumps from hacked sites by searching for it on https://haveibeenpwned.com/. It's good to have two-factor authentication on any accounts that have your financial details on it to help prevent people from stealing your identity or making fraudulent transactions. You should at least set up two-factor authentication for all banking accounts to help protect them.

I wholeheartedly recommend rolling into 2FA - login to your WF account via website, and 2 Factor is on "User settings".

If you have decent email security (strong password, but ideally strong random password + 2FA on email as well), this makes your WF account so much harder to take over. Strong password is 20 chars random, but 5 surprising words together, for example oxygen-expel-french-shortcake-doorframe also make up a better password than "12345678"

On top of that, password manager. Quite a few to choose from, please google their websites:

• Lastpass, free tier is more than enough for average user. UX can be a bit of a hit and miss for some users. My dad, 70ish years old, started using it last year and he even enjoys it. So it's simple to start using lastpass and consistenty update your passwords to secure ones over time.
• 1Password, glorified by many security experts. Only paid, but apparently excellent UX.
• Bitwarden, the one I use. Open source, nice dev working on it. You can pay up for more premium features but basic one is also great. Recently audited.

And there are many more password managers. I wouldn't trust some no-name password manager you can find in Google Play Store, but there about 10 recognised password managers that have been used by enough people to trust them (well, trust ish!).

And people will argue what is good/bad password manager, but ultimately, it's better to use SOME password manager, than no password manager at all.

And it's better to use email as 2FA than have no 2FA at all.

And if you want to be a smartass and say that your password is secure ;) , use this excellent password search by Troy Hunt and check if "scrappy123" or "1qaz2wsx" is really as secure as you have thought. https://haveibeenpwned.com/Passwords

To anyone reading this thread. If you don't have 2 factor authentication enabled, you risk ending up just like OP. Stop whatever you're doing now, and just fucking enable it already: https://www.playstation.com/en-us/account-security/2-step-verification/

OP: You may want to check if your password was leaked in one of public dumps here: https://haveibeenpwned.com/

You totally should do that but to be honest pretty much anyone who regularly posts content of any type on the internet will probably leave enough of a paper trail to be doxxed eventually. Even when you don't specifically fuck up, the websites you use will.

For example, this site lets you see how much your personal info has been leaked or hacked from website db's over the years. By combining enough of these leaks on you plus the times you actually divulged something about yourself, you're pretty much fucked.

In general just don't be a total twat on the internet. Be one within reason.

Very useful to check if your username or e-mail address was compromised in a data breach: https://haveibeenpwned.com/ - Developed by Troy Hunt, Microsoft Regional Director. You can also be notified by e-mail if a new data breach happens and your info is in it.

There are also websites you can go to to enter an email and see if it pops up. Here is a article that lists several sites you can search. This is one, here is another site you can search.

May your searches be fruitless and your relationships stay intact. Seriously, I hope you find nothing. That's the best case scenario here, and that's what I hope happens...

A few things here, and this is not just for Steam.

• Activate 2-Factor Authentication on your Steam account
• Use a password storage system like 1Password or LastPass
• Periodically check your email address on https://haveibeenpwned.com/
• Change your passwords periodically
• But most importantly Don't use the repeat username/password combos

That last one is critical because if one site gets hacked it gives the hacker access to all of the sites that share that username and password.

1. Everyone, ENABLED 2 STEP AUTHENTICATION! https://support.ubi.com/en-GB/Faqs/000025170/Secure-your-account-with-2-Step-Verification

2. Either Pengu's Email got hacked or he had the same password for both his Twitch and uPlay account and that password was the same as another password he used on some previously compromised account. (Non uPlay, could've been anything)

What do I mean by the same password as some previously compromised account?

What hackers will do is find hacked databases from other services, be it some defunct music streaming service, that major Yahoo hack or LinkedIn, Adobe or anything. Then, since a lot of people use the same password for all their accounts, the hackers will try using that email/password combo to log into your email address. If that doesn't work, they will just start logging into other services, ex: uPlay and Twitch, with that email / password combo and see if that works. Then, the hackers sell your account information to sellers which target specific audiences (gamers) or they resell the accounts themselves.

The best way to safeguard yourself is to have unique passwords. But I also highly suggest everyone running your email address through a website like https://haveibeenpwned.com - This will give you a list of websites that have been hacked which your email address shows up in.

If you've been compromised on some other service and you do use the same or similar passwords, you should change your password for any accounts that have that password.

This happened to a friend of mine and is more common than you may think. If you were hacked and couldn't figure out what happened, chances are it was something like this.

I wasn't aware of any password dumps from GameStop but it could have just been a quick paste and not publicized much. Have a look at https://haveibeenpwned.com - it aggregates all the high and low profile dumps it can get and will let you know if your creds have been leaked.

If things are posted online, publicly, and without a robots.txt (at some point, they can be protected later), google is going to crawl it. No matter how obscure the site is, if it is the only site where your email shows up in plain text it's going to be one of the first results.

Best thing you can do you've already done - changing all your shared passwords - but I hope you've changed all of them to something different. Having a bad password can let attackers compromise an account, but sharing passwords means attackers can get into every account, no matter how strong the password is.

Something you can do is visit haveibeenpwned.com

Here, you can enter your various email addresses, to see if they have been in any 'confirmed breaches'. If so, prioritize changing those passwords first.

&#x200B;

Second, it has a section you can use to test passwords, to see if they are also involved in known breaches.