Forced Password Resets

[Zaldir]

 

In response to post #42022505.

 

 

 

GraVmaN wrote: I think its unlikely anyone will buy that list so they can high jack a user account to post in the forums or download some files. Its more likely the email addresses will be used to send spam to. Looks like I am among the affected as my account was made almost 6 years ago. As such, I have changed my password of course. :D

XD you also have to remember some of these accounts could have real information...critical information like a credit card or such

 

No credit card information is stored on NexusMods.

[Helmic]

In response to post #42022505. #42910225 is also a reply to the same post.

GraVmaN wrote: I think its unlikely anyone will buy that list so they can high jack a user account to post in the forums or download some files. Its more likely the email addresses will be used to send spam to. Looks like I am among the affected as my account was made almost 6 years ago. As such, I have changed my password of course. :D

PositiveGamer101 wrote: XD you also have to remember some of these accounts could have real information...critical information like a credit card or such

Password reuse is common for people that aren't already using a password manager. A username/email/password combination presents a habit. If [email protected] uses the password l@ad7ph1dz on one site, they likely use that same email and password on another site. You're also attaching that email to a likely demographic and interest - if someone has a Nexus Mods account, they likely also have, say, a Steam or Humble Bundle or Battle.net account or anything else gaming-related.

Each individual account stolen doesn't have to be worth tens of thousands of dollars, it just needs to be worth something because they're dealing in bulk. Something high value like a Humble Bundle account can easily be flipped by grabbing all the keys and throwing them onto G2A who quite famously don't give a f*#@. The hacker would be using scripts to try all these accounts, comparing them to leaked emails from other sites to see who's been confirmed to be signed up where.

Or they might just use it for cheating. Log into someone else's Steam, hack in CS:GO or Overwatch and have fun, and when the banhammer comes down it's no skin off their nose.

Using a strong, unique password on each site is really the only way to stay safe nowadays, and that's just not going to be doable by human beings without the help of a password manager.