DLH.net data breach: 3.3M accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2016-09-07
In July 2016, the gaming news site DLH.net suffered a data breach which exposed 3.3M subscriber identities. Along with the keys used to redeem and activate games on the Steam platform, the breach also resulted in the exposure of email addresses, birth dates and salted MD5 password hashes. The data was donated to Have I Been Pwned by data breach monitoring service Vigilante.pw. Exposed data: dates of birth, email addresses, names, passwords, usernames, website activity. The breach dates from Jul 31, 2016; Have I Been Pwned loaded it on Sep 7, 2016.
What to do
- If you had a DLH.net account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
