The Post Millennial data breach: 57.0M accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2024-05-10
In May 2024, the conservative news website The Post Millennial suffered a data breach. The breach resulted in the defacement of the website and links posted to 3 different corpuses of data including hundreds of writers and editors (IP, physical address and email exposed), tens of thousands of subscribers to the site (name, email, username, phone and plain text password exposed), and tens of millions of email addresses from thousands of mailing lists alleged to have been used by The Post Millennial (this has not been independently verified). The mailing lists appear to be sourced from various campaigns not necessarily run by The Post Millennial and contain a variety of different personal attributes including name, phone and physical address (depending on the campaign). The data was subsequently posted to a popular hacking forum and extensively torrented. Exposed data: email addresses, genders, ip addresses, names, passwords, phone numbers, physical addresses, usernames. The breach dates from May 2, 2024; Have I Been Pwned loaded it on May 10, 2024.
What to do
- If you had a The Post Millennial account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
