Yandex Dump data breach: what leaked and what to do
Yandex Dump (forum.btcsec.com) had a data breach on 2014-09-07 affecting 1,186,564 accounts. Passwords were involved.
!Passwords leaked
Added to the catalogue 12 Sept 2014.
What leaked
- Email addresses
- Passwords
What happened
In September 2014, news broke of a massive leak of accounts from Yandex, the Russian search engine giants who also provides email services. The purported million "breached" accounts were disclosed at the same time as nearly 5M mail.ru accounts with both companies claiming the credentials were acquired via phishing scams rather than being obtained as a result of direct attacks against their services.
Description from Have I Been Pwned, in its words.
What to do
- Change the password on that service, and anywhere you used the same password. A password manager makes this painless.
- Turn on two-factor sign-in on that service and on your email.
- Warn staff: emails, texts or calls quoting leaked details are not proof the sender is genuine.
- If card or bank details leaked, watch statements and tell the bank; if identity documents leaked, consider a credit ban or alert.
Common questions
What leaked in the Yandex Dump breach?
Email addresses, Passwords
When did the Yandex Dump breach happen?
The breach date is 2014-09-07; it was added to the public catalogue on 2014-09-12.
What should I do if my staff used this service?
Change the password there and anywhere it was reused, turn on two-factor sign-in, and warn staff about emails quoting the leaked details.
Was a staff address in this breach?
Check one address free, no storage. Breach Watch checks every staff address after each new breach.