MDPI data breach: 845K accounts exposed
Severity: medium · Patch status: no-fix-needed · Since 2018-03-25
In August 2016, the Swiss scholarly open access publisher known as MDPI had 17.5GB of data obtained from an unprotected Mongo DB instance. The data contained email exchanges between MDPI and their authors and reviewers which included 845k unique email addresses. MDPI have confirmed that the system has since been protected and that no data of a sensitive nature was impacted. As such, they concluded that notification to their subscribers was not necessary due to the fact that all their authors and reviewers are available online on their website. Exposed data: email addresses, email messages, ip addresses, names. The breach dates from Aug 30, 2016; Have I Been Pwned loaded it on Mar 25, 2018.
What to do
- If you had a MDPI account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
Sources
All live incidents on Threat Watch