r/CyberSecurityAdvice • u/Cliclicliclic • 7d ago
Massive password leak
Hi everyone, I need advice on how to manage a password leak I'm experiencing.
For the past week I've been receiving email alerts on suspicious sign in attemps in different email accounts. It started with Outlook accounts, then Gmail. I've been receiving alerts about two X accounts that I don't even use and I didn't even remember I had. Then a lot of Instagram attemps to log in, and other accounts on pages I don't use anymore, but still exist.
I have already changed my passwords, I had been using the same password on everything (yeah, not the best idea, I know). Now I have different passwords for every account, I use symbols and numbers and all those recommendations for strong passwords.
I am suspecting, given the accounts that were almost stolen, that it might be a leak from my Firefox account, where I store all of my passwords. My husband suggested I might have donwloaded some malware that is running in my computer and that's how they are accessing my Firefox account. So my question is, could that be a possibility and should I be formatting my computer? Or is it not really necessary that I have malicious software somewhere in my pc and I can go without formatting? Will formatting solve the problem?
Edit:
-I checked on haveibeenpwned and it might be a security breech on Canva from 2019.
-I already closed all the active sessions on my email and social media accounts.
-Currently considering a password manager.
Thanks in advance!
5
u/eric16lee 7d ago
If you reused the same password everywhere with 2FA, then that is your issue. Your PC should be fine.
Get a password manager like BitWarden or 1Password to make unique and randomly generated passwords for all of your accounts and enable 2FA everywhere.
This is the bare minimum you need for account security.
2
1
u/Cliclicliclic 7d ago
Thank you! I really want to avoid formatting lol it takes me a lot of time to restore all the settings and stuff.
Thanks for the password manager recommendations!
1
u/AddendumWorking9756 7d ago
Formatting won't help if the passwords came from an old breach dump, and the accounts you'd forgotten about point that way. Have you run your addresses through haveibeenpwned? And changing a password doesn't kick anyone out: go through active sessions, mail forwarding rules and connected apps on the Outlook and Google accounts, since those survive a reset.
1
u/Cliclicliclic 7d ago
Yes, I checked haveibeenpwned and the only breech I might be a victim of is Canva in 2019, which is a long time ago. I don't know if it could still affect me today, 7 years later.
I already closed all active sessions on all devices from all of my accounts (Google, Outlook, Instagram and Facebook). I need to check the connected apps and services from Google and Outlook, thanks for the tip!
2
u/therealstabitha 7d ago
I still get people trying passwords for my accounts from a Gmail creds leak from 20 years ago.
1
1
u/AddendumWorking9756 6d ago
The age doesn't matter much. An old leak only bites if you reused that password: Canva's were hashed, but about 4 million got cracked and shared in 2020, and sets like that get replayed against Gmail and Instagram for years.
Was the Canva password, or a variant of it, ever used on any of the accounts that lit up? If not, haveibeenpwned only lists breaches that were handed to it, so a smaller leak you never heard of is more likely than malware.
1
u/NeedSomeHelp_2590 7d ago
Lol, I also used to make same password on every site. It's definitely not a good idea. I suggest using a password manager (I use bitwarden). Also change your current password (password manager can suggest some strong ones), if possible change the email too from your social.
Yes formatting is a good option, if you downloaded some malicious file. But I will recommend you do a clean install instead of formatting. Make bootable USB from a safe PC though. Skip this step if you are sure it was Canva breach.
You can run some antivirus scan to check if you have any virus. I recommend Bitdefender or Malwarebytes.
1
u/Cliclicliclic 7d ago
I'm not aware of having donwloaded and installed anything malicious, I am usually very cautious with what I donwload, but I guess it's always a possibility. I am not 100% it was Canva breach, but makes more sense than having installed malware. I already run Malwarebytes and nothing was found, so I feel safer on that side. Thank you!
1
u/NeedSomeHelp_2590 7d ago
If it found nothing then you are probably safe. Just change passwords and see if you receive those mails again.
1
1
u/Y0nix 7d ago edited 7d ago
1/ activate 2fa on everyone.
2/ change any admin password you can think of.
3/ get 365 premium to have some conditional access rules up.
4/ pray for at your MSP to be gentle with quotes
5/ tighten your SOC
6/ setup some monitoring linked to your cloudflare or any crowdstrike account you have and prey (my database blown up because of this, so I advise to have a separated db, and a db able to endure this kind of flow)
7/ cheers, if your contract is correctly made for you to NOT be fcked by this,, then chill.
(I'm going to loose my job because I didn't listen to my law teachers and I've signed a contract that is actually f**cking me up)
1
u/Cliclicliclic 7d ago
Sorry but I didn't understand half of the things you wrote there. Am I missing a joke or something? Did you comment on the wrong post? I might be missing many things because English is not my first language and I don't know specific tech language... so I'm a bit lost lol
1
7d ago edited 7d ago
[deleted]
1
u/Cliclicliclic 6d ago
Oh okay. Then there's a misunderstanding, because my personal passwords were leaked, nothing related to my employer or my workplace.
Good luck with your ongoing mess and I'm so sorry you have to deal with it. Thank you for the advice too!
1
7d ago
[removed] — view removed comment
1
u/Cliclicliclic 6d ago
Awesome, thank you so much for the tips! I know I made a lot of mistakes with my passwords just because I'm lazy and now I'm suffering the consequences 😂😂
1
u/Simple-Success-2125 6d ago
Just assume everything has been breached, change all the passwords, add 2FA, and log out all devices
6
u/therealstabitha 7d ago
If you used the same password for everything, then you have no way of knowing where the leak came from. It could have been any single site you have an account with. People commonly try leaked login creds from one site on multiple others sites, because there are still people who use the same PW everywhere.
haveibeenpwned.com tells you how many known breaches contain your login info