74

I recently was emailed from HaveIBeenPwned.com (which I am signed up on) about the ShareThis website/tool (not signed up on).

I have no memory of signing up for that service.

When I go to recover the account (I might as well close/change password), I get this:

reset password page for ShareThis, but with an error message that reads: 'No user with that Address. Need to Register?'

The two facts seem mutually exclusive:

Either I had an account and it was pwned, or I didn't have an account (and thus HIBP is in error)?

How do I find out the true situation, and what is the most secure course of action?

Improve this question
6
  • 1
    The dumps might also contain contact/invite database entries, so if somebody has uploaded an address book or you did „send this to a friend“ it all could be possible reasons. Does it say the dump contains a password?
    – eckes
    Commented Mar 4, 2019 at 20:01
  • 1
    Just adding that I had the same issue with the "ShareThis" hack. That list might have that behavoir
    – Ole Albers
    Commented Mar 5, 2019 at 9:09
  • Someone could have acted on the breach and already taken control of your account and changed the associated email address?
    – TylerH
    Commented Mar 5, 2019 at 17:40
  • @TylerH possibly, but my only concern would be them reusing my password on another site (unlikely as I don't reuse passwords) or impersonating me, which they can't do if they changed the email address, right?
    – AncientSwordRage
    Commented Mar 5, 2019 at 17:45
  • 1
    @Pureferret depends on the kind of information aside from your email address that was included in that site's profile/settings. If you're not familiar with the site and can't even login using the email address reported, you're probably safe. This was just an extremely edge case that popped into my head.
    – TylerH
    Commented Mar 5, 2019 at 17:49

5 Answers 5

Reset to default
124

From the FAQ:

Why do I see my email address as breached on a service I never signed up to?

When you search for an email address, you may see that address appear against breaches of sites you don't recall ever signing up to. There are many possible reasons for this including your data having been acquired by another service, the service rebranding itself as something else or someone else signing you up. For a more comprehensive overview, see Why am I in a data breach for a site I never signed up to?

It's likely some services allow signing up without confirming an email address, or that accounts that haven't confirmed email addresses are still stored indefinitely but cannot be logged in to, or any number of similar issues.

Improve this answer
11
  • 77
    One other possibility is that, more simply, the database where your address was found was a mix of multiple data leaks, with the majority of the data belonging to ShareThis.
    – DrakaSAN
    Commented Mar 4, 2019 at 17:07
  • 3
    @Pureferret The good part is that if you were included because (for instance) someone else mistakenly used your email address, then you don't have to worry about more sensitive information like passwords being leaked as well.
    – bta
    Commented Mar 4, 2019 at 18:28
  • 13
    @Pureferret This happens to me all the time. For some reason, some people keep registering accounts to various places with my primary email address. Sometimes I "forgot password" and lock them out, delete the accounts that way, or find contact information and tell them directly to stop using my email (within legal limits), usually I have to contact customer support for the service and demand that they disconnect my email from that account. There really needs to be some sort of public shaming for companies that do anything other than (re)send verification email to an unverified email.
    – mtraceur
    Commented Mar 5, 2019 at 0:01
  • 4
    @mtraceur From what I have seen the lack of verification is not even the result of low skill developers, its an intentional business choice to reduce friction for signing up to a service.
    – Qwertie
    Commented Mar 5, 2019 at 0:35
  • 14
    @user33040: Well, those addresses are identical to GMail. As are [email protected], [email protected], etc.
    – Dubu
    Commented Mar 5, 2019 at 10:14
76
+300

Adding on to what AndrolGenhald said, they have deactivated all accounts associated with the breach so theres a good chance it won't show up regardless:

ShareThis has already deactivated the ShareThis accounts potentially associated with this incident, so if you created an account prior to January 2017, you may no longer be able to log in.

https://www.sharethis.com/data-privacy-incident/

Improve this answer
3
  • 13
    Well spotted... Seems like an unusual approach?
    – AncientSwordRage
    Commented Mar 4, 2019 at 17:32
  • 3
    @Pureferret Unfortunately, I wouldn't know. I just got the email for our domain from HaveIBeenPwned today and was doing my reading on it.
    – hairydresden
    Commented Mar 4, 2019 at 17:56
  • 7
    On top of which, ShareThis might have expired the account after a period of inactivity anyway, regardless of a hack. A few months go I went through my passwords file to update some old insecure passwords on a bunch of unimportant sites and found that they had all expired my account for inactivity.
    – Paul Johnson
    Commented Mar 5, 2019 at 13:49
1

A bit late to this thread, but I just got an alert through my credit card about the sharethis breach. I never signed up for sharethis, but a quick search through my old emails found a couple of cases of people using the service to share an article with me. So I'm guessing that the database of email addresses of people on the receiving end of the service were also exposed.. which would explain why there was no hashed password leak associated with my address.

Improve this answer
0

While other contributors have responded with some great answers, I'll focus on the last part of your question:

How do I find out the true situation, and what is the most secure course of action?

Troy Hunt, a prominent security researcher launched HIBP with a purpose in mind to aggregate all leaked databases into a web app where users can search for their compromised email addresses.

What he started has come a long way and now there are many other websites they not only offer email searching but allows anyone to download the complete leaked dataset for free.

I know the following three that where you can download the complete dump files and to get to the source of truth, instead of relying on HIBP alone that doesn't offer much info due to privacy laws and stuff:

https://databases.today/search.php

https://www.vigilante.pw/

https://nuclearleaks.com/

Improve this answer
-2

As much as all of the theories are tangible, the biggest possibility is that the creator of the website is having a data issue, website X is meant to have ID X however has ID Y and thus is displaying data from ID Y. Why would anybody be signing up for services they won't be able to use with an email they cannot use either, they could just use random strings if it was a brute force attack.

Thus you've been been 'pwned' just not on the website it is incorrectly displaying.

I think this is the most probable cause.

Improve this answer
8
  • 3
    I..I don't follow any of what you've said. Which wesite, why would it have Y and not X...how would the wrong infor get to HIBP?
    – AncientSwordRage
    Commented Mar 6, 2019 at 13:34
  • You're telling me it's more logical for somebody to be putting in somebodies email for no reason, than for the person who coded the website to of made a real simple mistake? - X is a representative of anything, like N would be in maths. And if you're asking what website I'm talking about, the one the question is.. 'haveibeenpwned' I've just realised you've not read the question originally, which is why you're confused at my answer, to the question you've not read.
    – Jack Williams
    Commented Mar 6, 2019 at 13:36
  • 4
    Jack, I wrote the question. I don't know if you're saying the mistake is on HIBP, or the compromised website? Is ID an email address or like a database row ID?
    – AncientSwordRage
    Commented Mar 6, 2019 at 13:43
  • 2
    I doubt that it's just a mistake on HIBP's end.
    – ave
    Commented Mar 6, 2019 at 20:05
  • 2
    You're telling me it's more logical for somebody to be putting in somebodies email for no reason — As mtraceur observed in a comment on another answer, this happens all the time. Usually the "somebody" honestly thinks they have put in their own email address, despite all evidence to the contrary. xkcd.com/1279
    – zwol
    Commented Mar 7, 2019 at 15:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .