Forced Password Reset? Check Your Assumptions
Summary: Krebs on Security explains that the password reset demands users receive from sites like Glassdoor are often not breach notifications but efforts to flag accounts reusing credentials exposed in other companies' hacks. Glassdoor CIO Anthony Moisant confirmed the company stores username, salt value and scrypt hash in three columns and applies the stored salt and hash function to plain text passwords from leaked lists before comparing the result to its database.
Why it matters: Credential-stuffing attacks draw on millions or even billions of email addresses and cracked passwords from compromised databases, and Microsoft's Alex Weinert is cited saying an account is more than 99.9% less likely to be compromised with MFA - which Glassdoor did not yet offer at the time.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026