# Hack/break-in: New login from

**URL:** https://meta.discourse.org/t/hack-break-in-new-login-from/176286
**Category:** Support
**Created:** [January 16, 2021, 3:00pm UTC](https://meta.discourse.org/t/hack-break-in-new-login-from/176286 "2021-01-16T15:00:33Z")
**Posts on this page:** 1
**Showing post:** 4

<div class="post-metadata">

### Author: ![Falco](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/falco/32/179432_2.png) [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [January 16, 2021, 6:54pm UTC](https://meta.discourse.org/t/hack-break-in-new-login-from/176286/4 "2021-01-16T18:54:44Z")

</div>

> [@richb-hanover](#):
>
> Any idea how this might have happened?

Password reuse, weak passwords, keyloggers, shared wifi networks, etc

> [@richb-hanover](#):
>
> It appears that the attacker may have exported the user list. Is it possible to tell if it was ever downloaded?

Nginx logs.

> [@richb-hanover](#):
>
> Do you have a standard playbook/procedure for notifying users?

If the attacked may have obtained a backup, which needs email access too, there is [What to do if your Discourse is compromised](https://meta.discourse.org/t/what-to-do-if-your-discourse-is-compromised/40129)

If not, a banner topic or a topic in a category everyone is notified may suffice.

---

_[View the full topic](https://meta.discourse.org/t/hack-break-in-new-login-from/176286)._