Naming and Shaming the Plaintext Offenders
Summary: Krebs on Security reported that a hosting provider, Hosting Metro, responded to a password reset request by emailing the account's existing password in plain text, showing it stored the password without encryption or a protected format. Krebs cancelled his subscription, submitted a redacted screenshot to plaintextoffenders.com, and noted the practice is common among low-cost hosting providers.
Bottom line: A provider that can email your existing password back to you is holding it in a form it can read, so a single breach of that database hands attackers working credentials rather than hashes - and password reuse turns each one into a key to other accounts.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026