Gregory's ServerNew breach: Internet Archive had 31M records breached last month including email address, screen name and bcrypt password hash. 54% were already in @haveibeenpwned. Read more: https://www.bleepingcomputer.com/news/security/internet-archive-hacked-data-breach-impacts-31-million-users/
|
12 comments
I think you're mistaken, while HIBP has a paid service it will provide data on affected domains for free. Source: I monitor my domain for free at HIBP.  @asteriske @haveibeenpwned It is free until spammers have poisoned their database with more than a handful of invalid addresses at your domain when trying to guess a valid address. And then the next time you get an email notification of a breach and click through, you will encounter a paywall instead of the details of the breach. Even if you change yout password, assuming you can with the DDoS, you will have to change it again. Until the breach is fully hunted down, the exfil could occur again.   @haveibeenpwned I'm there too. Fed up of these breaches. The LinkedIn one of some years ago was the worst.  @haveibeenpwned that's just a email alias for me Strangly the password didn't get flagged by hibp |
@haveibeenpwned You sent me a mail telling me that an address in my single-user domain was involved in this breach. Thing is, I'm not a HIBP subscriber.
The link in the email took me to a page which wanted me to subscribe to a service which costs hundreds of dollars per year to see the details because apparently you think I am an ISP because your data is extremely dirty as it contains loads of invalid addresses generated by spammers using dictionary attacks.
So I forwarded the email to abuse@sendgrid.com pointing out it was spam. Because if you're bulk-sending mail to non-customers trying to get them to pay money, that's spam.
@haveibeenpwned You sent me a mail telling me that an address in my single-user domain was involved in this breach. Thing is, I'm not a HIBP subscriber.
The link in the email took me to a page which wanted me to subscribe to a service which costs hundreds of dollars per year to see the details because apparently you think I am an ISP because your data is extremely dirty as it contains loads of invalid addresses generated by spammers using dictionary attacks.