[{"data":1,"prerenderedAt":286},["ShallowReactive",2],{"blog-stories/password-breach-notification":3},{"id":4,"title":5,"body":6,"category":267,"date":268,"dateModified":268,"description":269,"draft":270,"extension":271,"faq":272,"featured":270,"headerVariant":267,"image":272,"keywords":272,"meta":273,"navigation":274,"ogDescription":275,"ogTitle":272,"path":276,"readTime":272,"schemaOrg":277,"schemaType":278,"seo":279,"sitemap":280,"stem":281,"tags":282,"twitterCard":284,"__hash__":285},"blog/blog/stories/password-breach-notification.md","The Password Breach That Affected a Recruiting Platform's Whole Team",{"type":7,"value":8,"toc":259},"minimark",[9,16,19,24,27,33,36,40,43,56,59,85,89,92,125,129,132,143,146,170,174,177,197,200,222,251],[10,11,12],"tldr",{},[13,14,15],"p",{},"A project management tool that a recruiting platform's team used got breached. Three team members had reused their work email passwords there, which led to credential stuffing attempts across the company's services. One account was successfully compromised before they caught it. The team implemented mandatory password managers and 2FA, and learned painful lessons about password hygiene.",[13,17,18],{},"The breach notification email seemed like routine spam at first. \"Your data may have been compromised in a recent security incident.\" The engineering team at the recruiting platform had all gotten hundreds of these. This one was different.",[20,21,23],"h2",{"id":22},"the-chain-reaction","The Chain Reaction",[13,25,26],{},"The breached service was a project management tool the team had used briefly two years ago. Most of the engineers had forgotten about it. But the email/password combinations were now in a database being sold on the dark web.",[28,29,30],"story-block",{},[13,31,32],{},"\"One of the developers got an alert from Google that someone in Vietnam had tried to log into their account. Then the company Slack showed a login from an unfamiliar IP. Then AWS sent a suspicious activity warning. It was all connected.\"",[13,34,35],{},"Three team members had committed the cardinal sin: using the same password for the breached service and their work accounts. The attackers were running automated credential stuffing attacks across popular services.",[20,37,39],{"id":38},"what-got-compromised","What Got Compromised",[13,41,42],{},"One team member's GitHub account was accessed before anyone realized what was happening. The attacker had:",[44,45,46,50,53],"ul",{},[47,48,49],"li",{},"Read access to private repositories",[47,51,52],{},"Viewed some environment variable configurations",[47,54,55],{},"Potentially cloned repository contents",[13,57,58],{},"Fortunately, the platform's actual secrets were in a separate vault, not in the repos. But it was too close for comfort.",[60,61,62,68],"warning-box",{},[13,63,64],{},[65,66,67],"strong",{},"What Enabled the Attack",[44,69,70,73,76,79,82],{},[47,71,72],{},"Password reuse across personal and work accounts",[47,74,75],{},"No mandatory 2FA policy for the team",[47,77,78],{},"Using personal emails for some work services",[47,80,81],{},"No monitoring for suspicious login attempts",[47,83,84],{},"Abandoned accounts on forgotten services",[20,86,88],{"id":87},"the-response","The Response",[13,90,91],{},"Once the team understood the scope, they moved fast:",[93,94,95,101,107,113,119],"ol",{},[47,96,97,100],{},[65,98,99],{},"Immediate password resets",": All team members reset passwords on all work services",[47,102,103,106],{},[65,104,105],{},"Session revocation",": Logged out all sessions everywhere",[47,108,109,112],{},[65,110,111],{},"2FA enforcement",": Mandatory 2FA on all work accounts within 24 hours",[47,114,115,118],{},[65,116,117],{},"Audit logs review",": Checked all services for unauthorized access",[47,120,121,124],{},[65,122,123],{},"API key rotation",": Rotated all keys that might have been visible in repos",[20,126,128],{"id":127},"the-new-policy","The New Policy",[13,130,131],{},"The recruiting platform implemented strict new requirements:",[133,134,139],"pre",{"className":135,"code":137,"language":138},[136],"language-text","Team Security Requirements:\n1. Password manager required (1Password Teams)\n2. Unique password for every service\n3. 2FA mandatory on all work accounts\n4. Hardware keys (YubiKey) for critical services\n5. Work email only for work services\n6. Regular HaveIBeenPwned checks\n7. Quarterly access review and cleanup\n","text",[140,141,137],"code",{"__ignoreMap":142},"",[13,144,145],{},"The team also set up alerts for breach notifications using services that monitor for company email addresses appearing in new breaches.",[147,148,150],"lesson-box",{"title":149},"Key Lessons Learned",[44,151,152,155,158,161,164,167],{},[47,153,154],{},"Password reuse is a ticking time bomb - every service you sign up for is a potential breach vector",[47,156,157],{},"Mandate password managers for teams - makes unique passwords practical",[47,159,160],{},"2FA should be non-negotiable for work accounts",[47,162,163],{},"Monitor for team credentials in breach databases",[47,165,166],{},"Audit and delete accounts on services you no longer use",[47,168,169],{},"Use work emails only for work services",[20,171,173],{"id":172},"checking-if-youre-affected","Checking If You're Affected",[13,175,176],{},"Everyone should regularly check if their credentials have been exposed:",[44,178,179,185,191],{},[47,180,181,184],{},[65,182,183],{},"HaveIBeenPwned.com",": Check if your email appears in known breaches",[47,186,187,190],{},[65,188,189],{},"Password manager breach monitoring",": 1Password, Bitwarden, and others offer this",[47,192,193,196],{},[65,194,195],{},"Google/Firefox password checkup",": Both browsers can check saved passwords against breaches",[13,198,199],{},"If you find your credentials in a breach, change that password everywhere you've used it. Better yet, use a password manager so you never reuse passwords again.",[201,202,203,210,216],"faq-section",{},[204,205,207],"faq-item",{"question":206},"How do credential stuffing attacks work?",[13,208,209],{},"Attackers take email/password pairs from one breach and automatically try them on many other services (Gmail, GitHub, AWS, etc.). Since many people reuse passwords, a surprising percentage of attempts succeed.",[204,211,213],{"question":212},"Is a password manager really necessary?",[13,214,215],{},"Yes. Humans can't remember unique, strong passwords for the dozens of services we use. Password managers make this practical and often catch when you try to reuse passwords or log into a phishing site.",[204,217,219],{"question":218},"What type of 2FA is most secure?",[13,220,221],{},"From most to least secure: hardware keys (YubiKey) > authenticator apps (Authy, Google Authenticator) > SMS codes. SMS is vulnerable to SIM swapping attacks, so avoid it for critical accounts if possible.",[223,224,225,231,236,241,246],"related-articles",{},[226,227],"related-card",{"description":228,"href":229,"title":230},"A freelance platform founder's honest account of their first security incident. The panic, the mistakes made during resp","/blog/stories/first-security-incident","A Freelance Platform Founder's First Security Incident",[226,232],{"description":233,"href":234,"title":235},"A practical guide based on our journey from security-ignorant to security-confident. The specific steps that got us ther","/blog/stories/from-zero-to-secure","From Zero Security to Sleep-at-Night Confidence",[226,237],{"description":238,"href":239,"title":240},"The story of an indie SaaS developer accidentally pushing secrets to a public GitHub repository. How it happened, how fa","/blog/stories/github-secrets-public","An Indie Developer's GitHub Secrets Went Public",[226,242],{"description":243,"href":244,"title":245},"A stranger found a health-tech startup's admin panel at /admin with no authentication. They could see all patient data, ","/blog/stories/admin-panel-found","When Someone Found a Health-Tech Startup's Unprotected Admin Panel",[226,247],{"description":248,"href":249,"title":250},"In early 2025, AI-assisted attackers compromised 50,000 FortiGate firewalls in weeks. Here's what happened and why it ma","/blog/stories/ai-assisted-fortigate-attack","How Attackers Used AI to Breach 50,000 FortiGate Firewalls",[252,253,256],"cta-box",{"href":254,"label":255},"/","Check Your Vibe Now",[13,257,258],{},"Scan your vibe coded projects for security vulnerabilities and authentication issues.",{"title":142,"searchDepth":260,"depth":260,"links":261},2,[262,263,264,265,266],{"id":22,"depth":260,"text":23},{"id":38,"depth":260,"text":39},{"id":87,"depth":260,"text":88},{"id":127,"depth":260,"text":128},{"id":172,"depth":260,"text":173},"stories","2026-02-16","A third-party service a recruiting platform used got breached, exposing credentials the team had reused. How credential stuffing almost compromised their systems.",false,"md",null,{},true,"A third-party breach led to credential stuffing attempts on a recruiting platform's systems.","/blog/stories/password-breach-notification","[object Object]","BlogPosting",{"title":5,"description":269},{"loc":276},"blog/stories/password-breach-notification",[283],"Security Story","summary_large_image","0zNd9aHdcmz-YcTe-ng5vnOUCgP60nScCKskAkJ7ZKc",1775843936297]