Slack Resets Passwords For Lazy Users Who Hadn’t Changed It Since 2015 Breach

If you use Slack, a popular cloud-based team collaboration
server, and recently received an email from the company about a
security incident, don’t panic and read this article before taking
any action.

Slack has been sending a “password reset” notification email to
all those users who had not yet changed passwords for their Slack
accounts since 2015 when the company suffered a massive data
breach.

For those unaware, in 2015, hackers unauthorisedly gained access
to one of the company’s databases that stored user profile
information, including their usernames, email addresses, and hashed
passwords.

At that time, attackers also secretly inserted code, probably on
the login page, which allowed them to capture plaintext passwords
entered by some Slack users during that time.

However, immediately following the security incident, the
company automatically reset passwords for those small number of
Slack users whose plaintext passwords were exposed, but asked other
affected users to change their passwords manually.

Keep calm and change your password ?

Slack is resetting the passwords for all those users
(approximately 1% of total) who hadn’t changed their passwords
since 2015 when the company experienced a #databreach leaking users’
credentialshttps://t.co/k6jSBgloAX^[1][2]

Check this thread: https://t.co/Fo7QbI9pOv^[3]

Now in its latest
statement^[5] released today, the
company said they learned about a new list of username and password
combinations that match with the login credentials of its users who
did not change their password after the 2015 data
breach^[6].

The latest security incident only affects users, who:

• created an account before March 2015,
• have not changed their password since the incident, and
• accounts that do not require logging in via a single-sign-on
  (SSO) provider.

The company is not exactly aware of the source
of this new leaked plaintext credentials, but suggests it could be
the “result of malware attack or password reuse between
services.”
It is also possible that someone might have successfully cracked
hashed passwords that were leaked in the 2015 data breach, even
when it was protected using the bcrypt algorithm with a randomly
generated salt per-password.

Late last month, Slack also sent a separate notification to all
the affected users informing them about the potential compromise of
their credentials without providing any details of the incident,
but it seems many users ignored the warning and did not change
their passwords voluntarily.

Therefore, now Slack has automatically reset passwords on
affected accounts, that are about 1% of the total registered users,
that haven’t been updated since 2015 as a precautionary measure,
asking them to set a new password using this guide.

Besides your changing password, you are also recommended to enable
two-factor authentication for your Slack accounts, even if you are
not affected.

Slack is still investigating the latest security incident and
promises to share more information as soon as they are
available.

^[7][8]