Hi folks, I’m an admin on another Discourse system, and this morning I awoke to four email messages, which indicated an unauthorized login (see sample below). I live in NH, US, so it is correct for Discourse to have flagged this log-in from Germany. I have always used a good password (15 letter, random, which I have now changed). I am in possession of the two computers which I ever used to log in. A few questions: Any idea how this might have happened? My profile page showed another login (also “from Germany…”) in the 24 hours prior to the message below. But I did not receive a notification for that login - either in my inbox or my spam folder. How might that have happened? It appears that the attacker may have exported the user list. Is it possible to tell if it was ever downloaded? Do you have a standard playbook/procedure for notifying users? What other information could I provide to diagnose or investigate this? Many thanks. [Sorry if this isn’t the right category. @moderators - please move to the right place. Thanks.]

Do you have 2FA activated? If not get that added ASAP

I don’t, but will activate 2FA. Any thoughts on the other questions? Thanks.

[image] richb-hanover: Any idea how this might have happened? Password reuse, weak passwords, keyloggers, shared wifi networks, etc [image] richb-hanover: It appears that the attacker may have exported the user list. Is it possible to tell if it was ever downloaded? Nginx logs. [image] richb-hanover: Do you have a standard playbook/procedure for notifying users? If the attacked may have obtained a backup, which needs email access too, there is What to do if your Discourse is compromised If not, a banner topic or a topic in a category everyone is notified may suffice.

Thanks for the note. Yes, I was asleep That IPv6 address is not from my range (I take from Hurricane Electric, in the 2001:470:… range) We have evidence that the intruder attempted to add their email to an admin account, download the user list, and get the database backup. No access was granted to the new email address; we assume they retrieved the user list; but that they could not get the latter (the database) because they had not yet got email address. So we assume emails and handles have been compromised, but that the database has not been downloaded (nginx logs). Are there other things we should look for? Many thanks.

Great to hear 3 of our protections were useful: Invader couldn’t get backups because of the needed email flow Invader couldn’t get admin on a email that he controls because there is emails to confirm to both addresses Warning emails when login happens from far away One thing that you should check is if Discourse is running the most recent version so it’s patched against any know vulnerabilities.

Yes, and each of those protections was individually added after a hard-earned lesson, so it’s especially satisfying to see them all working together in tandem! :raising_hands:

Hack/break-in: New login from

Product Support

pfaffman (Jay Pfaffman) January 16, 2021, 11:04pm 5

And that was while you were asleep? It’s not possible that you got a new Ipv6 address that maxmind just had the wrong location for?

Topic		Replies	Views
Discourse hacked via sophisticated social engineering Site feedback	9	7640	May 21, 2018
What to do if your Discourse is compromised Self-Hosting reference	0	10540	February 24, 2016
So I can't login anymore :( and won't receive email logins or forgotten password emails Product Support	9	2036	September 1, 2019
DiscourseConnect Provider Questions WordPress	37	3809	September 5, 2023
How do other admins deal with compromised accounts? Community Building	9	592	September 16, 2025

Hack/break-in: New login from

Related topics