Support / SUP-1143
Marlow: were any of our accounts used in the attack?
Description
Your status page says sign-in was attacked last night. Were any of our accounts used? Everyone at Marlow signs in with a password, so I'd like to know today.
Tom Ashby
Linked issues
- relates to OPS-41 Credential stuffing against password sign-in in the EU: about 1.9 million attempts Done
Comments (3)
Mira Holm · 3 Sep 2026, 10:30 UTC
Hi Tom, Mira Holm, security lead. No: no Marlow account was signed into by the attacker. We checked every successful sign-in in that window, one by one.
Nine Marlow emails were in the attackers' lists (attached). I'd ask those nine to change their passwords, especially if they use them anywhere else. Your three administrators use MFA, so a password alone wouldn't have opened the portal for them. Account lockout and limits on repeated attempts are coming next week.
Tom Ashby · 3 Sep 2026, 11:00 UTC
Thanks Mira. Will get those 9 to change today.
Hi Tom, our security lead is going through every sign-in from the night now. You'll have an answer before lunch.