El Calden Data Breach Reported: 513 Records With Emails and Hashes

A reported El Calden data breach, dated August 1, 2023, claims 513 records with email addresses and password hashes, as logged by HEROIC analysts. It is unverified. Your own address is the only thing that decides whether this matters to you.

Hashed Does Not Mean Harmless for Reused Passwords

A hash is a scrambled password. How hard it is to reverse depends on the method used, and the report names none. That uncertainty means a reused password deserves a change, since a recovered password would open every site that shares it. A guess against a hash can be repeated until it matches, and the person making the guesses does not need the original service to take part. Because the method behind these hashes is not stated, there is no reliable way to say how long a recovery would take. Acting early costs little time, while delay leaves the question open.

The Items Behind the 513 Figure

• Email addresses: where password resets and phishing messages are delivered.
• Password hashes: scrambled passwords that can be tested with guesses by anyone holding them.

What a Matching Hash and Address Allow

A person holding both can test guesses without touching the original site. A successful guess becomes a login for that service and for others using the same password. Inbox takeover, identity fraud and payment fraud are the consequences to plan for. A phishing message that quotes your address can add to the pressure, so verify any request that arrives after a report like this by going to the service directly instead of following a link.

What a Database Record Contains

A database record is a copy of what one service stored about its users. This report concerns that kind of record and remains unconfirmed.

Does El Calden Include Your Email?

See where you stand: scan your email and see your information. On a match, change the password here and on any site that shared it, and use a different one for each. Be wary of messages mentioning El Calden that ask you to click. Your work address belongs in the same check.