Is there any sign of anything happenjng? a demand for money? Personally I wouldn’t find an email the least bit concerning. 🗑️ Unless it contained significant proof of confidential information.

Please copy and paste the email here, so we can see exactly what it says.

You've been pwned!

You signed up for notifications when your account was pwned in a data breach and unfortunately, it's happened. Here's what's known about the breach:

Email found:

I deleted the email address.

Breach:

Naz.API

Date of breach:

20 Sep 2023

Number of accounts:

70,840,771

Compromised data:

Email addresses, Passwords

Description:

In September 2023, over 100GB of stealer logs and credential stuffing lists titled "Naz.API" was posted to a popular hacking forum. The incident contained a combination of email address and plain text password pairs alongside the service they were entered into, and standalone credential pairs obtained from unnamed sources. In total, the corpus of data included 71M unique email addresses and 100M unique passwords.

2 Steps to Better Password Security

Monitoring Have I Been Pwned for data breaches is a great start, now try these next 2 steps to protect all your accounts:

Step 1: Protect yourself with strong, unique passwords for each website with the 1Password password manager

Step 2: Enable 2 factor authentication and store the codes inside your 1Password account

You can also run a search for breaches of your email address again at any time to get a complete list of sites where your account has been compromised.

Check my email address again

Why are you only hearing about this now? Whilst the breach occurred in September 2023, sometimes there can be a lengthy lead time of months or even years before the data is disclosed publicly. Have I Been Pwned will always attempt to alert you ASAP, it's just a question of how readily available the data is.

Please note that it is not possible to retrieve the passwords themselves from HIBP. If you don't want to receive any future breach notifications, just click here to unsubscribe.

Donate to Have I Been Pwned

If you loved this service and want to know what goes into making it possible, have a read of the donations page. Buy me a coffee or a beer or just some time with the kids at a movie.

I would ignore it. If concerned, change your passwords for email or other sites of importance.

Have a good cocktail hour, a nice dinner, and sleep well.

Change passwords to financial, medical, and other sensitive sites if you’re concerned. But I suspect the key motivation here is ”donate” 🙂

Any financial institution, etc that has a data breach would be notifying you themselces. This is nonsense.

Reads like a sales pitch, imo.

Thanks, everyone. I will change my password on some stuff. I feel better now!

Looks like a scam to me. I've gotten many emails over the years telling me that my computer has been hacked and they know everything about me and all my passwords and yada yada yada.... These are just scams trying to scare people into giving up money like as if that is going to fix something?! Don't be a victim to these scammers.

I was just fretting to my husband just a couple of days ago, I'm getting so annoyed with the fact that everywhere you turn someone is trying to scam people. I mean you can't even mail a frigging check anymore for crying out loud! A person is scared to hired a repair man for fear he's a con man trying to steal your money! When will this ever end? UGH! So dang sick of it! The latest thing where we live is someone installed a credit card scanner at our local Walmart store and it was there for almost a MONTH before it was detected. It got installed at a self checkout. I tried to ask an employee which line it was in so I would know if it was one that I used but of course they couldn't divulge any information at all.

Have I Been Pwned is a legit website - did you sign up there for alerts? All they are saying is that your info has turned up on a site that shares stolen email/passwords.

I have checked there from time to time to see if any of my passwords have been compromised, and found that one was.

It is a good idea to change the password that they found, on any site where you use it. It is a pain, but necessary to protect yourself.

Sites like this do depend upon user donations. Asking for a donation is also legit, not a scam.

I don't think there is anyone left on earth who hasn't had their passwords stolen or log ins compromised.

2 factor authentication (when available) and unique log ins/passwords for every site are the best defenses. That way if one gets stolen, you only have to change the log in for that 1 account. And with 2FA, you get alerted instantly if someone is trying to log in, so that helps tremendously.

raee - Good to know it’s a legit website. I’d still be pretry confident that if it involved sensitive information, the institutions would have reached out directly.

I joined "Have I been pwned" sever years ago. I have never gotten anything like this message before. I change my password on my email accounts, figure it sure can't hurt. Thank you all. I really appreciate your knowledge and help.

This used to be the first site for me every a.m. (KT), back when Shelba, Tiger, etc were here. I found it the first day it opened. Somehow, seems like I do mostly FB now, But I love to check in and see what is happeing here sometimes.

Thanks again!

I forgot I signed up with them until I read this. It's most certainly legit, and you can check which sites/companies were breached and change your password, like raee stated.

I haven't heard from them for awhile, but I did get a couple notifications in the past. it turned out to be some old online accounts I no longer used, so just deleted/closed them.

One problem can be if you used the same password for more than one account, which I did a few times, before I knew better

" Asking for a donation is also legit, not a scam."

I disagree, it's certainly fear-motivated in this case.

Also remember that sometimes things may look like they came from a legit company but if you hover your mouse over the email address it's something completely bogus.

Not a scam, not a for-profit.

https://haveibeenpwned.com/FAQs#DataSource

https://haveibeenpwned.com/Passwords

P.S. I apparently had a number of breaches, and deleted my accounts on a couple of them. Will be updating email passwords as well.