this post was submitted on 26 Feb 2025
316 points (99.1% liked)
Technology
63375 readers
6440 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
I don't understand how to find out which specific sites had my data leaked. Without that I can't take any action. I'm subscribed to email alerts but the alert did not include any details like the article said it would.
As another poster detailed, this is not a company that exposed your info: these credentials are all from stealer logs, which are logs of credentials stolen by keyloggers installed on machines. If your credentials were in this report, it means that you've entered that username and password on a machine with malware on it. Could be your personal machine, or it could be some other computer you've used.
That's true. My point was just that the important thing here is knowing personally which domains were affected so one can personally change those sets of credentials. If I don't know which of my credentials leaked then there's no value to me.
I was able to finally get access and did change the specific credential that had leaked (again, not assigning blame to any specific site here).
Use the 'Notify me' option and verify your email address, and then it will show the expanded list of domains that were exposed from the malware:
Thanks, I finally found it. I was already subscribed and verified, but still couldn't find this anywhere. To get to it I had to:
My natural question is of course how my credentials were stolen logging into gmail.com (yay 2-factor), but at least know I know that's where I need to change my password.
I should note that the initial notice email about the breach that I received from HIBP for already being verified appears to not have any direct way to actually get this information.
Mine just said it was found, but no domains were associated. So... Yea. I don't know what it has, and the inability to query it for more information sucks.
You're not alone. I'm on the list, but no domain data and I don't have the 'stealer log entries' available.
Rent a domain Set up email Use a unique address for every website
I usually pick the domain of the website as the username part.
So if, say, I have email set up on lemmy.cafe and want to sign up to flatearth.com - I'd probably use [email protected] for an email address. If they ever leak it - I'll be reveiving spam sent to this address.
In the six years of hosting my own email I've only had one such occurence when namecheap got breached. It was nice being able to tell where the culprit was!