# Hack/break-in: New login from

**URL:** <https://meta.discourse.org/t/hack-break-in-new-login-from/176286>\
**Category:** Product Support\
**Created:** [January 16, 2021, 3:00pm UTC](https://meta.discourse.org/t/hack-break-in-new-login-from/176286 "2021-01-16T15:00:33Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![richb-hanover](https://avatars.discourse-cdn.com/v4/letter/r/919ad9/32.png) [@richb-hanover](https://meta.discourse.org/u/richb-hanover)\
**Post date:** [January 16, 2021, 3:00pm UTC](https://meta.discourse.org/t/hack-break-in-new-login-from/176286/1 "2021-01-16T15:00:33Z")

</div>

Hi folks, I’m an admin on another Discourse system, and this morning I awoke to four email messages, which indicated an unauthorized login (see sample below).

I live in NH, US, so it is correct for Discourse to have flagged this log-in from Germany. I have always used a good password (15 letter, random, which I have now changed). I am in possession of the two computers which I ever used to log in.

A few questions:

1. Any idea how this might have happened?
2. My profile page showed another login (also “from Germany…”) in the 24 hours prior to the message below. But I did not receive a notification for that login - either in my inbox or my spam folder. How might that have happened?
3. It appears that the attacker may have exported the user list. Is it possible to tell if it was ever downloaded?
4. Do you have a standard playbook/procedure for notifying users?
5. What other information could I provide to diagnose or investigate this?

Many thanks.

[Sorry if this isn’t the right category. [@moderators](https://meta.discourse.org/groups/moderators) - please move to the right place. Thanks.]

> [@](#):
>
> ====== Note received overnight =======
> 
> > Begin forwarded message:  
> > **From:** XXX Forum \<[mail@xxx-forum](mailto:mail@xxx-forum)\>  
> > **Subject:** **[xxx Forum] New Login from Germany**  
> > **Date:** January 15, 2021 at 11:04:14 PM EST  
> > **To:** [my-email](mailto:my-email@gmail.com)  
> > **Reply-To:** xxx Forum \<[mail@xxx-forum](mailto:mail@xxx-forum)\>
> > 
> > Hello,
> > 
> > We noticed a login from a device or location you don’t usually use. Was this you?
> > 
> > - Location: Germany (2a0b:f4c2:2::1)
> > - Browser: Firefox
> > - Device: Windows Computer – Microsoft Windows
> > 
> > If this was you, great! There’s nothing else you need to do.
> > 
> > If this was not you, please [review your existing sessions](https://xxx-forum/my/preferences/account) and consider changing your password.

---

_[View the full topic](https://meta.discourse.org/t/hack-break-in-new-login-from/176286)._