In the digital age, protecting your personal information might seem like an impossible task. We’re here to help.
This is a community for sharing news about privacy, posting information about cool privacy tools and services, and getting advice about your privacy journey.
You can subscribe to this community from any Kbin or Lemmy instance:
Check out our website at privacyguides.org before asking your questions here. We've tried answering the common questions and recommendations there!
Want to get involved? The website is open-source on GitHub, and your help would be appreciated!
This community is the "official" Privacy Guides community on Lemmy, which can be verified here. Other "Privacy Guides" communities on other Lemmy servers are not moderated by this team or associated with the website.
Moderation Rules:
Additional Resources:
I was going to glibly respond that you should change any compromised passwords. On reading the notification it doesn't seem like they have provided exactly which sites were affected, so I understand the question now, and can only suggest researching the Stealer Logs breach. Not particularly helpful sorry.
Further investigation turned up this
https://www.troyhunt.com/experimenting-with-stealer-logs-in-have-i-been-pwned/
Yep, thats the blogpost from the owner of haveibeenpwnd regarding the email OP received.
OP, it seems like you have or had malware on one or more of your devices that has been logging all of your credentials to any services you signed into on the infected devices with the email address provided in the screenshot you shared.
we're talking about the logs created by malware running on infected machines. You know that game cheat you downloaded? Or that crack for the pirated software product? Or the video of your colleague doing something that sounded crazy but you thought you'd better download and run that executable program showing it just to be sure? That's just a few different ways you end up with malware on your machine that then watches what you're doing and logs it.
These logs all came from the same person and each time the poor bloke visited a website and logged in, the malware snared the URL, his email address and his password.
I would suggest running a malware scan on devices you use to log in with that email.
On a secure device, you should change the passwords for each service that you use that email with.
If 2FA is already enabled on any of these accounts, then it should be safe and I would ensure the device is not infected before changing the passwords or else the passwords will be stolen again when you sign in on the infected device.
It is likely any other accounts that were signed into on the infected device have had their credentials stolen too, you may not have those email addresses set up to receive this notification. Also you should notify anyone else who has used the infected device that their credentials were likely stolen too.
You can check if other emails have been comprised using https://haveibeenpwned.com/ and you can also check if passwords have been comprised there too.
To add to this, here's what I would do personally:
For disinfecting devices, it's a process:
Some additional things to do:
Very thorough explanation!
I'll add a basic info for @[email protected]: every service MUST have a different password (password manager almost mandatory with a VERY strong password and 2FA).
If you're paranoid like me ( 🙈 ) use a different email alias for each service (SimpleLogin)
if OP trusts their service, they can check the passwords they used with this email to find the compromised one and change it.
also, a significant number of ppl use one email per service. for example, they add stuff to google mail addresses or use yahoo disposable emails. those would know it from the email address in the mail.