Emotet data breach: 4.3M accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2021-04-26
In January 2021, the FBI in partnership with the Dutch NHTCU, German BKA and other international law enforcement agencies brought down the world's most dangerous malware: Emotet. The agencies obtained data collected by the malware and provided impacted email addresses to HIBP so that impacted individuals and domain owners could assess their exposure. Read more about the takedown and recommended actions. Exposed data: email addresses, passwords. The breach dates from Jan 27, 2021; Have I Been Pwned loaded it on Apr 26, 2021.
What to do
- If you had a Emotet account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
