These two actions together should mitigate how much damage the API keys contained within the leak can cause at this point in time. We have also disabled the ability to login via API key. We could not confirm that all API keys were correctly reset after the initial breach, so we have reset all API keys again as a precautionary measure. However, if you used the same password for other services, we recommend you exercise caution and consider changing your passwords regardless.ĪPI keys: These are of particular note – while they were primarily used for the client to interact with the web service, they could also be used to log in to the website and subsequently access an account, including any uploaded (public and private) puushes. This means your passwords should be safe – bcrypt is a one-way algorithm and you cannot feasibly retrieve the password from a bcrypt hash.

Hashed passwords: Passwords were hashed with the industry-standard bcrypt before storage. Depending on your expectation of privacy, this may or may not be a concern for you. They could also make connections between emails and usernames (if set). Usernames & emails: Someone obtaining the leak would be able to determine if a given domain or email address had an associated puush account. Whilst from 2015, the information contained in the leak still consists of potentially sensitive data, such as: usernames, email addresses, hashed passwords (bcrypt) and API keys.

We have identified you as an active puush user, so we’re reaching out for two reasons:įirstly, it has come to our attention that somebody is trying to sell data obtained from the breach back in 2015 ( ). Thanks for your continued usage of puush.

I'll post the email we have sent out to active users so there's no missing context:

What is sharex puush