devkitPro data breach: 1508 accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2019-02-11
In February 2019, the devkitPro forum suffered a data breach. The phpBB based forum had 1,508 unique email addresses exposed in the breach alongside forum posts, private messages and passwords stored as weak salted hashes. The data breach was self-submitted to HIBP by the forum operator. Exposed data: email addresses, passwords, private messages. The breach dates from Feb 3, 2019; Have I Been Pwned loaded it on Feb 11, 2019.
What to do
- If you had a devkitPro account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch