76

I recently was emailed from HaveIBeenPwned.com (which I am signed up on) about the ShareThis website/tool (not signed up on).

I have no memory of signing up for that service.

When I go to recover the account (I might as well close/change password), I get this:

reset password page for ShareThis, but with an error message that reads: 'No user with that Address. Need to Register?'

The two facts seem mutually exclusive:

Either I had an account and it was pwned, or I didn't have an account (and thus HIBP is in error)?

How do I find out the true situation, and what is the most secure course of action?

  • 1
    The dumps might also contain contact/invite database entries, so if somebody has uploaded an address book or you did „send this to a friend“ it all could be possible reasons. Does it say the dump contains a password? – eckes Mar 4 at 20:01
  • 1
    Just adding that I had the same issue with the "ShareThis" hack. That list might have that behavoir – Ole Albers Mar 5 at 9:09
  • Someone could have acted on the breach and already taken control of your account and changed the associated email address? – TylerH Mar 5 at 17:40
  • @TylerH possibly, but my only concern would be them reusing my password on another site (unlikely as I don't reuse passwords) or impersonating me, which they can't do if they changed the email address, right? – Pureferret Mar 5 at 17:45
  • 1
    @Pureferret depends on the kind of information aside from your email address that was included in that site's profile/settings. If you're not familiar with the site and can't even login using the email address reported, you're probably safe. This was just an extremely edge case that popped into my head. – TylerH Mar 5 at 17:49
128

From the FAQ:

Why do I see my email address as breached on a service I never signed up to?

When you search for an email address, you may see that address appear against breaches of sites you don't recall ever signing up to. There are many possible reasons for this including your data having been acquired by another service, the service rebranding itself as something else or someone else signing you up. For a more comprehensive overview, see Why am I in a data breach for a site I never signed up to?

It's likely some services allow signing up without confirming an email address, or that accounts that haven't confirmed email addresses are still stored indefinitely but cannot be logged in to, or any number of similar issues.

  • 77
    One other possibility is that, more simply, the database where your address was found was a mix of multiple data leaks, with the majority of the data belonging to ShareThis. – DrakaSAN Mar 4 at 17:07
  • 3
    @Pureferret The good part is that if you were included because (for instance) someone else mistakenly used your email address, then you don't have to worry about more sensitive information like passwords being leaked as well. – bta Mar 4 at 18:28
  • 13
    @Pureferret This happens to me all the time. For some reason, some people keep registering accounts to various places with my primary email address. Sometimes I "forgot password" and lock them out, delete the accounts that way, or find contact information and tell them directly to stop using my email (within legal limits), usually I have to contact customer support for the service and demand that they disconnect my email from that account. There really needs to be some sort of public shaming for companies that do anything other than (re)send verification email to an unverified email. – mtraceur Mar 5 at 0:01
  • 4
    @mtraceur From what I have seen the lack of verification is not even the result of low skill developers, its an intentional business choice to reduce friction for signing up to a service. – Qwertie Mar 5 at 0:35
  • 13
    @user33040: Well, those addresses are identical to GMail. As are na.me.sur.name@gmail.com, n.a.m.e.s.u.r.n.a.m.e@gmail.com, etc. – Dubu Mar 5 at 10:14
79
+300

Adding on to what AndrolGenhald said, they have deactivated all accounts associated with the breach so theres a good chance it won't show up regardless:

ShareThis has already deactivated the ShareThis accounts potentially associated with this incident, so if you created an account prior to January 2017, you may no longer be able to log in.

https://www.sharethis.com/data-privacy-incident/

  • 13
    Well spotted... Seems like an unusual approach? – Pureferret Mar 4 at 17:32
  • 3
    @Pureferret Unfortunately, I wouldn't know. I just got the email for our domain from HaveIBeenPwned today and was doing my reading on it. – hairydresden Mar 4 at 17:56
  • 7
    On top of which, ShareThis might have expired the account after a period of inactivity anyway, regardless of a hack. A few months go I went through my passwords file to update some old insecure passwords on a bunch of unimportant sites and found that they had all expired my account for inactivity. – Paul Johnson Mar 5 at 13:49
0

While other contributors have responded with some great answers, I'll focus on the last part of your question:

How do I find out the true situation, and what is the most secure course of action?

Troy Hunt, a prominent security researcher launched HIBP with a purpose in mind to aggregate all leaked databases into a web app where users can search for their compromised email addresses.

What he started has come a long way and now there are many other websites they not only offer email searching but allows anyone to download the complete leaked dataset for free.

I know the following three that where you can download the complete dump files and to get to the source of truth, instead of relying on HIBP alone that doesn't offer much info due to privacy laws and stuff:

https://databases.today/search.php

https://www.vigilante.pw/

https://nuclearleaks.com/

-1

As much as all of the theories are tangible, the biggest possibility is that the creator of the website is having a data issue, website X is meant to have ID X however has ID Y and thus is displaying data from ID Y. Why would anybody be signing up for services they won't be able to use with an email they cannot use either, they could just use random strings if it was a brute force attack.

Thus you've been been 'pwned' just not on the website it is incorrectly displaying.

I think this is the most probable cause.

  • 3
    I..I don't follow any of what you've said. Which wesite, why would it have Y and not X...how would the wrong infor get to HIBP? – Pureferret Mar 6 at 13:34
  • You're telling me it's more logical for somebody to be putting in somebodies email for no reason, than for the person who coded the website to of made a real simple mistake? - X is a representative of anything, like N would be in maths. And if you're asking what website I'm talking about, the one the question is.. 'haveibeenpwned' I've just realised you've not read the question originally, which is why you're confused at my answer, to the question you've not read. – Jack Williams Mar 6 at 13:36
  • 4
    Jack, I wrote the question. I don't know if you're saying the mistake is on HIBP, or the compromised website? Is ID an email address or like a database row ID? – Pureferret Mar 6 at 13:43
  • 2
    I doubt that it's just a mistake on HIBP's end. – Ave Mar 6 at 20:05
  • 2
    You're telling me it's more logical for somebody to be putting in somebodies email for no reason — As mtraceur observed in a comment on another answer, this happens all the time. Usually the "somebody" honestly thinks they have put in their own email address, despite all evidence to the contrary. xkcd.com/1279 – zwol Mar 7 at 15:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.