WordPress Resets 100,000 Passwords After Google Account Leak

Password Reuse is Not a Fictional Issue; it's a Clear and Present Danger. Just Ask Popular Blogging Service, WordPress.com. Last week, Information on 5 Million Google Accounts was Publicly Posted on a Russian Bitcoin Forum Website. On September 10, Google Responded to the Issue by Publicly Denying that, its Website had been Breached and Claiming that Fewer than 2% of the Accounts in the Russian Breach List were actually Valid. As it Turns Out, although Google itself Didn't See Much Impact, the Exposure from the 5 Million Accounts is Broader than just Google. Late Evening on September 12, WordPress Revealed that, it was Taking Proactive Measures to Secure its WordPress.com Users against the Google Account Disclosure. WordPress has an Open-Source Content Management System (CMS) as Well an Online Service at WordPress.com, Where Users Can Create their Own Blogs.


WordPress.com Accounts Can also be Used by Self-Hosted Open-Source WordPress Users to Get a Number of Services from WordPress.com. "This list was not generated as a result of an exploit of WordPress.com but, since a number of emails on the list matched email addresses associated with WordPress.com accounts, we took steps to protect our users", WordPress Staffer, Daryl Houston Wrote in a Blog Post. "We downloaded the list, compared it to our user database and proactively reset over 100,000 accounts for which the password given in the list matched the WordPress.com password." So to Recap, Information on 5 Million Google Accounts was Publicly Posted and the Information Didn't Come from a Breach of either Google or WordPress.com.


Google has Stated that, Approximately 2% of its Users were Impacted, which Works Out to be Approximately 100,000 Users — Not Coincidentally, the Same Number of Accounts that WordPress has Reset. WordPress.com, like Google, is also being Proactive with its Users about the Potential Risk. While the Only Immediately Vulnerable Users from the Google Accounts Disclosure are those with a Valid Username and Password, there is still a Potential Risk for the Other Accounts as well. Houston Noted that, in Addition to the 100,000 WordPress.com Accounts that were Reset, an Additional 600,000 WordPress Accounts are also Potentially at Risk, since the Account Emails are on the Leaked Google Account List.


"Since these users were not immediately vulnerable, we did not reset their passwords or send emails but we will be enabling a notification in their dashboards so that, they can assess the security of their passwords at their leisure and with all of this information in hand", Houston Wrote. Clearly, Users Reuse Accounts and Passwords across Websites. It's a Risk that Security Experts Often Have Warned of, after Many Breaches and it's Not a Theoretical Risk. Simply Put, Password Reuse Increases the Risk for Users Whenever a Breach Occurs. The Unfortunate Reality of the Modern World is that, Breaches are a Common Occurrence so, the Prudent Course of Action is to Have Unique Passwords for Different Sites to Minimize the Risk.