Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [breach]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
1 answer
1k views

My personal info was leaked on the dark web through my Gmail Account; is it still safe to continue using said Gmail Account?

I have been using my personal Gmail Account for years to create accounts on a wide range of websites like evite.com and Instagram. Google conducted a dark web scan and created a report of instances ...
lcd12375's user avatar
0 votes
1 answer
128 views

CRIME like attack and locality of randomized data

I am not an information security expert (just a developer) and recently discovered this kind of vulnerability, and have a few questions (so sorry if I misinterpreted something about how the attack ...
Skary's user avatar
  • 103
0 votes
1 answer
171 views

CRIME and BREACH attacks, HTTP/2 and HTTP/3

I have been reading on CRIME and BREACH attacks and I want to learn better how to protect against them. From what I understood, those attacks require TLS encryption over HTTP compression and HTTP ...
Alexandre's user avatar
  • 101
0 votes
0 answers
328 views

How to find out which data breach my password was in?

HIBP and my password manager both claim that a password that I am using has been seen in a data leak. Neither of them provide information about which data leak exactly my password was seen in. The ...
InfiniteLoop's user avatar
1 vote
0 answers
149 views

What can somebody do with just name and passport number?

What is the risk if just full name and passport number were to be leaked? just those two pieces of information and nothing else.
user280088's user avatar
1 vote
1 answer
300 views

Data breach for my router in chrome

I have just logged into my router in Chrome, Win 10. I got this warning. I immediately changed the password. But I have several questions. Is the message reliable, in the sense that the breach ...
sancho.s ReinstateMonicaCellio's user avatar
0 votes
0 answers
283 views

Google says my password has been found in data breach. HIBP knows nothing about it. Which data breach was that?

I've been using Chrome to save and sync my passwords across devices (and lately I am trying to switch to Bitwarden). Google warned me recently about a password I have used across multiple sites that ...
dragi's user avatar
  • 101
1 vote
3 answers
1k views

Effective ways to hash phone numbers?

Suppose a company wants to implement 2FA for it's users using phone number OTP system, but does not really want to store their phone numbers as it could get breached and phone numbers are considered ...
Abhishek Choudhary's user avatar
0 votes
1 answer
339 views

How to secure Laravel website against the ongoing massive exploitation

My website built upon Laravel is currently under attack. Only the index.php file was changed, and by that I mean that every line of code is inserted above the original Laravel code. So this code ...
Hassan Nasir's user avatar
0 votes
0 answers
218 views

Historical examples of breached TOTP secrets?

While reading about password breaches, it occurred to me; where are the TOTP shared secret breaches? Because TOTP relies on a shared secret (unlike say U2F) the server has a copy of the shared secret, ...
user8187's user avatar
  • 141
0 votes
3 answers
231 views

How are data breach lists sourced and distributed?

I understand at an elementary level how data breaches tend to be distributed, starting with friends of the attacker/discoverer and then being distributed via forums, paste bins, etc. However I was ...
Rivesticles's user avatar
0 votes
1 answer
137 views

Database of breached websites

I run a website with a user database. I have an account with my email and I put it on a website like Have I Been Pwned, which does not reveal a breach. I also check the website's list of breaches to ...
emonigma's user avatar
  • 113
0 votes
1 answer
117 views

How to monitor your user accounts for breached logins?

On a few rare instances, I've received an email from a website notifying me that my email and password were found in batch of harvested logins, and they then force me to change my password. This has ...
Cerin's user avatar
  • 101
0 votes
4 answers
264 views

Why can't you use the same password for every site, if they are hashed on the site?

I've often heard people talking about not using the same password on every website. What's the deal if servers store passwords in a SHA hash instead of plain text? The most they can do is spam you ...
randomcake's user avatar
11 votes
1 answer
862 views

Why are water treatment facilities or similar connected to the internet? [closed]

I have a (sensitive) background in security, in short, I believe that the infrastructures MUST NOT connect to the internet. If you connect to the internet, it is a matter of time before it is breached....
kelalaka's user avatar
  • 5,559
0 votes
1 answer
158 views

How Were FireEye's Tools Exfiltrated?

What was the mechanism for exfiltrating FireEye's redhat tools in the recent SolarWinds hack? I understand it was via HTTP (small packets to many servers)? Are there any further details? Is this a ...
Ryan's user avatar
  • 173
3 votes
2 answers
786 views

Does replacing the SIM card mitigate any threats after a serious data breach?

I recently heard that a telephone company (a mobile network operator) was hacked and lots of data was stolen, maybe affecting up to a million customers. It sounds like the leaked data is already ...
reed's user avatar
  • 15.8k
11 votes
1 answer
554 views

SolarWinds Orion SAML compromise mass cert update

SolarWinds Orion customers have suffered some network compromises according to news reports. One report says, right at the end of the article, that SAML2.0 signing certificates may have been ...
O. Jones's user avatar
  • 379
1 vote
1 answer
287 views

We were hacked and have no idea how [closed]

Last Friday, 7 of our employees' office365 email accounts were hacked simultaneously. We saw successful logins from random US addresses. The virus went through emails and basically does a reply-all ...
Don Draper's user avatar
1 vote
1 answer
137 views

Are there services to detect data breaches?

There have been quite a lot of data breaches in the past and I wonder how the companies got to know them. Were they only finding it in the news? Did individuals inform them? What about small data ...
Martin Thoma's user avatar
  • 3,932
9 votes
3 answers
43k views

I woke up and my email has been signed up to hundreds of online services. How can I fix this?

I woke up this morning to over 900 emails of several online services asking to confirm I’ve made an account. Last month my email had been compromised and they managed to get into my eBay and Amazon ...
Yo average commenter's user avatar
0 votes
1 answer
147 views

How do maintainers calculate x number of accounts compromised by hack? [closed]

I am always curious by reports in the news of big network sites getting hacked and the report confidently stating a statistic such as "only 10,000 users were affected" or "Microsoft confirms 40,000 ...
Martin Joiner's user avatar
0 votes
0 answers
196 views

Has this PC been hacked? What's going on?

I'm reasonably technically competent, but I don't know how to interpret this PC issue. As its a real-world incident, there's some back-story. I'm in the UK. The suspect PC runs Win8.1 up to date, ...
Stilez's user avatar
  • 1,694
4 votes
2 answers
1k views

Does TLS 1.3 mitigate the BREACH vulnerability?

Section 5.4 of the TLS 1.3 specification describes record padding. One of the mitigations for BREACH is to add random padding. Therefore, I'm wondering: Does TLS 1.3 require random record padding? I'...
candrews's user avatar
  • 141
0 votes
1 answer
145 views

Database breach protection [duplicate]

I'm developing an API which requires an API key to use. These keys are assigned to users. To figure out which user the key belongs to, I have to store some information in that key. But I don't want it ...
DoomBro_Max's user avatar
2 votes
3 answers
584 views

What is the difference between a data leak and a data breach?

What is the difference between data leak and data breach? Could you give an example of what the insider threat would be for a data leak and a data breach? Reading the section "Who Causes Data ...
mark820850's user avatar
9 votes
3 answers
1k views

Is there a benefit to using a different email for every online account?

I have a domain email address which in addition to being able to create multiple mail accounts allows the creation of aliases for each inbox. Is there any benefit to security in using a different ...
Wuubb's user avatar
  • 91
2 votes
1 answer
744 views

How to check if a user's password has appeared in a breach?

The latest advice (e.g. from NIST) recommends that user's password are checked against known breaches and compromised passwords are forbidden. What are some relatively straightforward steps that a ...
paj28's user avatar
  • 33.4k
5 votes
2 answers
3k views

How are websites actually mititating BREACH? (HTTPS + compression)

After reading some popular questions and answer on this website about BREACH, the only advice seems to be: don't compress anything that might contain secrets (including CSRF tokens). However, that ...
reed's user avatar
  • 15.8k
3 votes
0 answers
135 views

Any data on how many users change passwords after a breach notifcation?

Does anyone know of any study or any data whatsoever which might indicate how many users actually change their passwords after they have been notified that their credentials appeared in a breach?
john doe's user avatar
  • 708
8 votes
2 answers
2k views

GMail Hack with 2-Factor Auth enabled

I have my business email on GMail. I use 2-factor authentication for access to said business email. I access my business email from 2 computers and 1 mobile Android device. I do not use Outlook or ...
PLBarton's user avatar
8 votes
2 answers
1k views

Does cloudflare protect against BREACH attacks?

I know that enabling http compression would make a server vulnerable to the BREACH attacks. So we have disabled compression from the server side, tested and it was all good. Then we implemented ...
Anonymous Platypus's user avatar
0 votes
0 answers
149 views

What authentication systems have been involved in data breaches?

Recently, a Federal Judge ordered Marriott to reveal the forensics report for its data breach. I know the Courts have sided with businesses in the past to keep the forensic details of breaches from ...
gethopr's user avatar
  • 41
48 votes
10 answers
20k views

Global variables and information security

I get the impression that it is a programming best practice to create variables in specific scopes (like a function scope) and avoid global scope to make things more modular and better organized. ...
user avatar
0 votes
1 answer
618 views

Why would I 'have been pwned' on a website that I never had an account on? [duplicate]

I was recently sent a notification by https://haveibeenpwned.com/ that one of my email addresses has been found in a breach, in particular in a breach of https://www.chegg.com. I am positive I never ...
Sebastiaan van den Broek's user avatar
0 votes
1 answer
141 views

Phishing emails and securing set up from compromise?

I'm a one-man company and I'm getting a lot of phishing emails very similar to the emails from companies I use. Some of these companies and the emails we exchange are very unique. How would these ...
adam78's user avatar
  • 121
3 votes
4 answers
1k views

How to investigate an IP address that was involved a security breach?

I'm wondering what one can do if they have the IP addresses that were used by the attackers during a security breach? The specific situation is this - recently two of our servers were hacked into ...
Abe Miessler's user avatar
  • 8,175
4 votes
1 answer
178 views

Repercussions on Google account used to access a compromised service

Suppose the following scenario: A cloud service reports a breach in which user account information (usernames and password data, e.g. password hashes) was accessed. The attacker has sufficient ...
user149408's user avatar
1 vote
0 answers
157 views

WhatsApp spyware application through WhatsApp call [duplicate]

Probably everyone heard that there was high security vulnerability in WhatsApp this week https://www.forbes.com/sites/zakdoffman/2019/05/14/whatsapps-cybersecurity-breach-phones-hit-with-israeli-...
Rovshan Musayev's user avatar
0 votes
0 answers
122 views

Network Breach - Possibility

Hypothetically, if someone had unauthorized access to my network, there are a lot of things that can happen, depending on the point of attack and how it accessed, I can assume that anything that is ...
mph85's user avatar
  • 125
-1 votes
2 answers
237 views

How does a hacker get access to my files if he got access to another user's files on a shared server? [closed]

I host files on a shared server with Ubuntu 14.04. How does a hacker get access to my files if he got access to another user's files and how do I prevent it?
Brutus Cruciatus's user avatar
1 vote
1 answer
138 views

Are there any known examples of companies who were successfully breached using POODLE, BEAST or SWEET32?

When this was first announced back in 2014, Brian Krebs reported on how much of a threat these kinds of birthday attacks were, but I have not been able to find a case study of a successful breach. Is ...
Pete Mahon's user avatar
2 votes
1 answer
221 views

Receiving Junk Email that is related to Skype conversations

My Microsoft email address and account are linked to Skype, OneDrive and Windows 10 (products I use by Microsoft). This account is not linked to my phone (Android). I don't use this account for Email (...
Nuno's user avatar
  • 215
74 votes
5 answers
27k views

How can I be pwned if I'm not registered on the compromised site?

I recently was emailed from HaveIBeenPwned.com (which I am signed up on) about the ShareThis website/tool (not signed up on). I have no memory of signing up for that service. When I go to recover ...
AncientSwordRage's user avatar
0 votes
2 answers
214 views

A website had a breach and isn't telling customers. What can I do?

A website recently had a bug where users could effortlessly inadvertently access and operate other users accounts - payment information and all. This website has an official community forum where ...
guestp-p-p-panda's user avatar
8 votes
2 answers
11k views

Why is breach-detection site "Have I Been Pwned" considered safe?

Whether it be due to technology the site is using, or any manual behind-the-scenes work with the data, why does this breach detection site seem to be unquestioningly safe? Wouldn't the data of you, ...
Nohbdy Ahtall's user avatar
105 votes
7 answers
143k views

Is it safe to give my email address to a service like haveibeenpwned in light of the publication of "Collection #1"?

There is a new big case of stolen login/password data in the news. At the same time, I am reading that there are services that let you check if your own login data is affected, e.g. Have I Been Pwned. ...
godwana's user avatar
  • 931
1 vote
1 answer
4k views

Got "Security alert" e-mail from Google about a sign-in from an unknown device I'd like to track down [closed]

How can I investigate a potential security breach on my Google account that was perpetrated via an unknown device that I do not own? I just got a horrifying e-mail from Google that seemed to indicate ...
ShieldOfSalvation's user avatar
1 vote
3 answers
385 views

Why are data breaches like the one at Quora considered so bad?

Today, I read this article that said that some hacker stole personal information of 100 million users of Quora — which allegedly is half of the total user base of Quora. This is kind of like when ...
gagantous's user avatar
  • 193
1 vote
2 answers
3k views

GDPR - Personal Data breaches for invoices

A short question and scenario. Company X receives by mistake invoice of Company Y ( there is no relation between them ). Company X is reporting the case to Controller : - invoice is not mine , ...
GDPR_noob's user avatar