0

One of the banks that provides identity theft monitoring to accountholders notified me that my email address was included in a recent data breach, along with a password, but without any indication of where this email and password was used. I asked if they could provide the (already compromised) password so I could find the affected account in my password manager, they said they didn't actually have the password included in the breach (huh?), and recommended I change the password on my email account. I don't see how changing the password on my email account will counter the compromise of an unknown account.

What's the basis for recommending resetting my email password when an unknown account password is compromised?


This is the entirety of the information in their alert:

breach report

Their response to my subsequent inquiry looked like a form letter and didn't answer my question, and included this recommendation:

If you have any affiliation with the website listed in the alert details as the source of the data breach, you should change your account password for that website, and also any of your other passwords that are the same as that password.

If you do not recognize the website listed in the alert details as the source of the breach, then you should change the password for your email account, and also any of your other passwords that are the same as that password.

Which is unhelpful because there is no website listed in the details. When I asked why they recommend changing the password for my email account they did not respond.

1

This is the most salient part:

you should change your account password for that website, and also any of your other passwords that are the same as that password.

Many people are not security savvy. Some people reuse the same password across multiple accounts. Like both their email and bank accounts. This is what enables credential stuffing attacks to succeed. This is not saying that you are security naive. If the bank is sending this to everyone affected then they're reasoning that this situation applies to some amount of people involved. Remember that the credential dump included the email address associated with the password. The second attack to attempt would be checking that password against that email account.

I have to send out these notifications from time-to-time. I prefer adding some additional suggested steps:

  1. Change your password for the affected service.
  2. Choose a strong password (password strength advice goes here).
  3. Do not use the same password across multiple services.
  4. Use a password manager (suggestions go here).
  5. Do not use your corporate email address for personal business.

Suggestions 2 and 3 go towards defeating credential stuffing. Suggestion 4 is meant to make suggestions 2 and 3 less painful.

1
  • How is that part salient when there is no "that website"? How are they getting from "we have no information about where these credentials were used" to "you should reset the password for your email account"? Is that connection justified? If it's based on the assumption that users are using the same password for their email account as for every account they log in to using their email address, is it still justified after I let them know that I have thousands of passwords in my password manager so the odds of that being the one that's comprised seem rather low? Apr 11 at 19:44
0

without any indication of where this email and password was used

Then the notification is worthless. My guess is that they did, in fact, indicate what account the email was used on or had explained more.

they said they didn't actually have the password

That's normal. They have signed up for a service like Have I Been Pwned that notifies when credentials have been included in a breach, but they do not store the passwords (for obvious reasons).

recommended I change the password on my email account

Again, I think there is some miscommunication. No, changing the email account password is not the thing you need to do, you need to change the password on the account that was compromised.

I would look over the material provided by your bank to see if they have mentioned which account was compromised.

20
  • 1
    Actually, the recommendation to change the email password is derived from the idea that a lot of people are using their email passwords to protect other accounts. So it is suggested by default.
    – nethero
    Apr 11 at 8:40
  • 1
    @KamilKurzynowski that makes zero sense. The recommendation would be to change the password everywhere you've used it, not just on an arbitrary service's account. And that's a very, very specific assumption.
    – schroeder
    Apr 11 at 8:51
  • This doesn't answer the question; I added a screenshot so you can see that they did not indicate what account was compromised. Apr 11 at 9:26
  • What's this "obvious" reason to not store compromised passwords? If the notification included the password (or a part of it) it would not be worthless. Apr 11 at 9:27
  • I did answer with "No, changing the email account password is not the thing you need to do, you need to change the password on the account that was compromised."
    – schroeder
    Apr 11 at 9:29
-1

First check your email id in the website https://haveibeenpwned.com/ to determine whether your account with email id has been found in any of the breached website.

If yes, Please don't use the same password in any other accounts, you used for that particular breached website.

1
  • 1
    This doesn't actually answer the question asked. This is a recommendation for an alternate approach. Also, the last line isn't really useful if the password has already been reused.
    – schroeder
    Apr 11 at 9:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.