Divinity Data Breach Reported: 889 Records Listing Emails, Hashes

HEROIC analysts reviewed a reported data breach record named Divinity. The report lists 889 records dated August 1, 2023, naming email addresses and password hashes. Nothing in the report is verified, so the details are claims, and only a check can show whether your address is among them.

A Hashed Password Is Not a Safe One

A hash scrambles a password so that it is not stored as typed. Scrambling slows an attacker down. It does not stop one who can try guesses against it, and a password chosen from a predictable pattern gives way first. The risk is therefore tied to how strong the original password was and whether it was reused.

What Sits in Each Column

• Email Address, your sign-in name and the address phishing would target.
• Password Hash, a scrambled password with no method named in the record.

No hash method appears in the record, so this post does not name one.

From a Cracked Hash to a Takeover

A cracked hash is a password in plain view. The attacker then tries it on the mailbox first, because a mailbox can reset other logins, and on any service where the same address is used. One repeated password is enough to link them.

What a Database Record Means Here

A database record is a row copied from a system's own tables. In this report the claim is that rows listing addresses and hashes were taken and shared. The claim is unconfirmed, which is why this page says reported throughout.

Is Your Address in the Report?

Run the check yourself: scan your email and see your information. Change the password on any matching login and anywhere you repeated it. Add your work address to the same check, since the report does not separate work from personal addresses. Treat the claim as a reason to review your passwords, whatever the outcome. A strong, unique password is a dependable defense against a hash that gets cracked, because it leaves nothing to reuse.