33

I have received one of those typical sextortion scams ("drive-by exploit", filmed by webcam (mine has tape on it), pay bitcoin etc.). The thing is that an old password of mine is included (I don't even remember where I used it), but searching the password on HaveIBeenPwned returns nothing (I have previously been notified of two leaks, Last.FM and MyFitnessPal, but those accounts use different passwords).

That got me wondering: since this seems to be a rather old password, how complete are databases like HaveIBeenPwned, and where could I report such a new exploit, other than the authorities?

Improve this question
14
  • 2
    I don't see how this relates to the question.
    – user32849
    Jul 24, 2019 at 15:19
  • 49
    No breach site can ever claim to be complete.
    – schroeder ♦
    Jul 24, 2019 at 15:20
  • 2
    Interesting you mention MyFitnessPal - I had the same email this morning, to an address I rarely use online, with an old password. I also went to HaveIBeenPwned and the only site that comes up for that email is MyFitnessPal, and same as you the password for that was different anyway (I still changed it though). I did a deep dive through Last Pass to find anywhere else is used that password (it brought up a few really old logins I haven't used in years), so it may have been any of those (they'll all get updated)
    – Midavalo
    Jul 25, 2019 at 4:36
  • 8
    @RonJohn I think they just sent a message implying that they filmed him ("we have full access to your system and can see you naked through your webcam, we have this password to prove it"). As in they didn't ever have access to the webcam, but they're hoping OP believes them.
    – JMac
    Jul 25, 2019 at 11:40
  • 4
    It is also worth noting that HaveIBeenPwned will not show you breaches for more sensitive (adult) sites like AshleyMadison unless you go through the email verification process to prove that you own the affected email, associated with the breach record.
    – shellster
    Jul 25, 2019 at 17:21

3 Answers 3

Reset to default
57

While services like HaveIBeenPwned are fairly extensive, there are still many stolen user / password lists that have not been revealed to the public eye. Maybe a company didn't actually disclose what happened, never realized anything happened, and/or no researcher has yet found the list. Unless you somehow find the list that included that password somewhere, there isn't a good option to try and report this incident.

Improve this answer
2
  • 32
    Also worth noting that this is a very common tactic. They find a forum or website somewhere that has SQLi, dump the passwords, find the ones that aren't yet public, then send sextortion emails to that subset of users using the password as false leverage to "prove" that they know something about you that "couldn't" be known unless they had access to your computer.
    – Polynomial
    Jul 24, 2019 at 22:37
  • 19
    I'd be slightly surprised if they bother filtering out accounts listed on HaveIBeenPwned. To fall for the scam you already have to not know about the scam and not know where to look to find out that it's a widely-reported scam. To also not know about HaveIBeenPwned isn't much of a leap from there, so the scammers might as well send it anyway.
    – Steve Jessop
    Jul 25, 2019 at 13:05
6

Services like HaveIBeenPwned only store passwords that have been publicly leaked in attacks. They have no way of knowing if you have changed your password since, and they have no way of knowing if your password has been leaked via other means.

EDIT: just noticed that you were searching your passwords on there. You might have better luck searching usernames or email addresses

Improve this answer
3

To add, Troy Hunt has previously stated that there are occasions where he has been in receipt of compromised credentials and has decided NOT to include those in HIBP.

https://www.troyhunt.com/the-red-cross-blood-service-australias-largest-ever-leak-of-personal-data/

"As a result, I offered to permanently delete the copy I was sent and not load it into HIBP. As of Thursday evening, that's precisely what I did - permanently deleted every trace of it I had. This isn't unprecedented, I took the same steps as part of the clean-up in the wake of the VTech data breach and for all the same reasons it made sense then, it makes sense now. As with VTech, this should give those who were exposed in the incident just a little bit more peace of mind that their data has been contained to the fullest extent possible."

In practice, the ones in HIBPe will have already been in circulation amongst the 'bad guys' for some time, and have either already been exploited or have been determined to be not worth the effort.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .