valkyrieriders[.]com account was compromised

[lastrogue]

Got a notice from a 3rd party monitoring service that my account over on valkyrieriders[.]com was compromised. more specifically in the notice it referenced members[.]vrccservices[.]com

I don't recall if this site has much ties to that one, but I had a membership registration over there.

I can't get into any portion of the site to change my credentials as it seems to be riddled with errors.

Just posting a note here to hopefully bring some attention to it so if the owner of the site is here they can take some action.

It is possible it is only my account, yet unlikely. I use a long complex unintelligible password that is vastly different on every site. So it is more likely that this is a whole site compromise. I highly recommend that if you have an account there and use the same password anywhere else, you change it now. Prioritize bank accounts, e-mail, etc.

[lastrogue]

I checked a public repo for my account and it was indeed showing the same password I used on the site. I checked for other accounts there and there are many more. I have notified the site contact email registered to the site.

Hoping to get the word out to anyone else who had an account there.

Those credentials are all public now. So I seriously recommend changing your passwords.

[DirtyDan]

So glad I’ve got NOTHING important on the internet

Dan

[Timbo1]

I checked a public repo for my account and it was indeed showing the same password I used on the site. I checked for other accounts there and there are many more. I have notified the site contact email registered to the site.

Hoping to get the word out to anyone else who had an account there.

Those credentials are all public now. So I seriously recommend changing your passwords.

As a followup recommendation I notice that http://www.valkyrieforum.com does not force or redirect to a secure connection (SSL) to the profile page when updating ones account.  So if you decide to update your password or anything else please make sure you have https://www.valkyrieforum.com in your address bar else your new password or anything else may be passed in clear text instead of being encrypted.