videohelp data breach

[SPL HUNTER]

Looks like the website has been hacked and username / passwords stolen - anyone any information on this or have experienced similar?

[flashandpan007]

How do you know?

[johns0]

Sounds like it it's only your computer that got hacked if someone else logged in on your name.

[SPL HUNTER]

nope - i use unique email addresses for every site i log into - my username and password has def been hacked

[SPL HUNTER]

i own my own domain and change the pre@ to each site - ive started receiving spam today with the person saying they know my password and telling me what it is

[johns0]

Do a malwarebytes scan,might find something there.

[SPL HUNTER]

thanks - nothing on the computer - just on email

[lingyi]

i own my own domain and change the pre@ to each site - ive started receiving spam today with the person saying they know my password and telling me what it is

Occam's Razor at play here. Haven't received any email and AFAIK, no one is posting stupid things here or being a d**k, (I can do that fine all by myself, thank you. <grin>)

Curious as to what the sender's endgame is other than just trying to gaslight you. Please keep us posted as to how and if this results in anything interesting.

[lordsmurf]

i own my own domain and change the pre@ to each site - ive started receiving spam today with the person saying they know my password and telling me what it is

Your server was more likely hacked.
Your own domain? Hosted where, how (what panel)?

However, this is a very common spam trick, so not hacking anything may have occurred.

[johns0]

I had the same thing happen to me saying to pay him to a bitcoin link,i just deleted the email,just another idiot trying to get free money,have had people from apple,paypal saying i needed to change my password and such.

[aedipuss]

if the hacker provided the correct password along with the email address, then the user database here at VH has been accessed and stolen. it's not that hard or uncommon. i'd advise all users to change their passwords. happy new year :-\

[lingyi]

If the VH server was hacked, I would think there would be more users getting emails. We'll see as the days go by. Changing passwords is a good idea either way.

[TimA-C]

Have you ever accessed the site via an insecure wifi network? Do you get your browser to remember log-in details?

[blud7]

Chrome tells me there was a data breach of my password for this site as well and suggested I change it.

[TimA-C]

How do you think Chrome would know if a website had been hacked? Unless they did it? Or, maybe, the data breach was somehow google related . . . ?

[Iamback]

If you want, check here
https://haveibeenpwned.com/

[blud7]

How do you think Chrome would know if a website had been hacked? Unless they did it? Or, maybe, the data breach was somehow google related . . . ?

I'm not saying it isn't. It's probably a Google leak, who knows. I'm just saying that when I open this site Chrome warns me that my password is compromised and I should change it. I tried with a clean browser on a brand new PC BTW. (Recently built a new PC). Actually will change it today.

[aedipuss]

the problem becomes that even if you change your password, if the hacker is still able to access the site database he will be able to get the new passwords whenever he wants. so it really doesn't matter, until the hole in the dike is plugged.

[johnmeyer]

This could be an attempt to trick the site operators into doing something that could then be detected or used by a hacker. If I were the site operator, I'd proceed cautiously.

As for me, I see this as a complete non-issue. I mean, what could anyone do with my Videohelp information? Learn how to fix broken videos? If so, hack away!

[johns0]

If you want, check here
https://haveibeenpwned.com/

That's a bogus site,i just changed all my passwords and it said i was pwned on 8 different sites.

[Iamback]

https://www.digitaltrends.com/computing/best-websites-for-finding-out-if-youve-been-hacked/
https://en.wikipedia.org/wiki/Have_I_Been_Pwned%3F
https://www.troyhunt.com/the-legitimisation-of-have-i-been-pwned/

[aedipuss]

If you want, check here
https://haveibeenpwned.com/

That's a bogus site,i just changed all my passwords and it said i was pwned on 8 different sites.

they don't update the lists if you change your passwords. it's just you were pwned at the time and will forever be listed that way. i think the total is up to like 6,000,000,000 accounts that have been hacked at one time or another :-\

[johns0]

The site doesn't account for vpn so it thinks someone else has your email info.

[lingyi]

@SPL HUNTER

You state you used a unique email address for this site, but did you use a unique password? Whomever emailed you could have garnered you email from this site and password separately and chanced putting the two together in the email to you. Unless there's demand for something from you, the only advantage I can see to having mined this site for data is to spam this site or you inbox. Neither of which I've seen (at least my inbox) happen so far.

[lingyi]

the problem becomes that even if you change your password, if the hacker is still able to access the site database he will be able to get the new passwords whenever he wants. so it really doesn't matter, until the hole in the dike is plugged.

Thinking about it, this is another remote possibility. Hoping that we would reuse a password that we use on other sites.

[lordsmurf]

Chrome tells me there was a data breach of my password for this site as well and suggested I change it.

I call BS.
Chrome says no such thing.

[johns0]

Sounds like malicious adware on the chrome,any browser can be infected with such stuff if not careful.

[Cornucopia]

HaveIbeenpwned is a very useful tool site that our institution's security officer has much faith in. (And I have MUCH faith in his technical/IT security chops) Could be you are using/interpreting it improperly.

Scott

[blud7]

Chrome tells me there was a data breach of my password for this site as well and suggested I change it.

I call BS.
Chrome says no such thing.

[Attachment 51315 - Click to enlarge]

Here's your BS.

Sounds like malicious adware on the chrome,any browser can be infected with such stuff if not careful.

I think maybe Google had a data breach.

[lordsmurf]

Here's your BS.

But is that Chrome, or a plugin/addon?
I see no such thing in Chrome.

HaveIbeenpwned is a very useful tool site that our institution's security officer has much faith in. (And I have MUCH faith in his technical/IT security chops) Could be you are using/interpreting it improperly.
Scott

It has limited value. It basically archives any known hack to date, but not much else.