Pwned accounts?

[nurunet]

Hi,

I activated a watch for my domain on Have I Been Pwned, and recently received a notification that credentials linked to DiMA with an email address I use exclusively for DiMA had been found in a collection of breached credentials called Cit0day. Is it possible that DiMA has been compromised?

I have changed my login data.

Ciao
Ben

[startedblue]

Thanks for the heads up! I've gone ahead and changed my password too!

[nurunet]

I now found my email address on dehashed with the comment "Sourced from diecastmodelaircraft.com (Cit0day) data". I'd say this is very strong evidence that DiMA has been compromised at some point. I'd love to know when, and whether whatever security issue allowed this has been fixed. Otherwise any change of email address and/or password is rather moot.