Reported Dont Forget Data Breach Lists 873 Records With Hashes

HEROIC analysts reviewed a reported data breach record named Dont Forget. The report lists 873 records dated August 1, 2023, naming email addresses and password hashes. The breach has not been verified, so it is a claim and should be read that way. Whether your own address appears is something only a check can tell you.

What 873 Hashed Entries Put in Play

A password hash is a scrambled form of a password. It has to be cracked before it can be used, which gives a defender time, but time is not the same as safety. A hash can be paired with an address, and the weaker passwords are the first to give way to guessing. If you reused a password across logins, that habit gives you reason to pay attention to the claim.

The Two Items the Record Lists

• Email Address, the sign-in name and the target for phishing messages that mention the name.
• Password Hash, a scrambled password that is only as safe as the original was strong.

The record does not name a hashing method, and this post does not guess one.

Where a Reported Hash Leads

A cracked hash becomes a password an attacker can type. If that password was reused, the next target is another login tied to the same address, starting with email itself. Because the report is unverified, treat it as a prompt to tighten your own habits and not as a finding about anyone.

How Database Records Get Out

A database record is a row copied from a company's own systems, such as a table holding addresses and stored passwords. Such copies can be taken through a flaw in a web application, an exposed server or misused credentials. This post cannot say which route applies to a named record, only what the record is claimed to list.

Where Does Your Address Stand?

To find out, scan your email and see your information. If your address shows up, change the password for that login and for any other login that shared it, then pick a different password for each. Work addresses and personal addresses both belong in the check. A reported record is worth a pause, and the pause costs less than a reset after a takeover.