Support / SUP-1140
Greenhollow: failed sign-ins overnight in our log, were we affected?
Description
Our sign-in log is full of failed sign-ins from last night, for office staff's emails. Were we affected? Do our phone codes need changing?
Aoife Brennan, Operations manager
Linked issues
- relates to OPS-41 Credential stuffing against password sign-in in the EU: about 1.9 million attempts Done
Comments (3)
Mira Holm · 3 Sep 2026, 10:10 UTC
Hi Aoife, Mira Holm, security lead at ACME. Some of Greenhollow's office staff's emails were in the attackers' lists: 14 people, list attached. No attempt from the attacking addresses signed in; we checked every successful sign-in in that window. Phone codes weren't touched: the attack only used the password form, so nothing to change there.
Please ask the 14 to change their passwords, especially anyone who uses the same password elsewhere. Account lockout and limits on repeated attempts are coming next week.
Aoife Brennan · 3 Sep 2026, 10:40 UTC
Done, all 14 asked to change. Thanks for the quick answer.
Hi Aoife, we're on it. Overnight someone tried email and password pairs stolen from other services against password sign-in, at several of our customers. Our security lead is checking every sign-in in that window and will write to you before lunch.