14 DAY TRIAL // AdGuard's CEO's Andrey Meshkov has announced on the company blog through a security notice that the company has reset the passwords for all registered accounts following a credential stuffing attack.
According to Meshkov's report, the attackers tried combinations of user/passwords to see if anything from their database of leaked data fit any AdGuard account credentials.
The attack was detected by AdGuard's team after a streak of consecutive login attempts into AdGuard's account system started coming in from a wide range of suspect IPs from around the world.
However, the attack was stopped not long after automated rate limiters put in place by the AdGuard team decided that the company's servers had enough login attempts for a while.
As an immediate response to this credential stuffing attack, AdGuard reset all passwords to all accounts to make sure that their users' data is safe.
AdGuard is considering to implement two-factor authentication to increase their users' security
Additionally, more strict requirements for creating passwords when making or updating an AdGuard account have been put in place, as well as a system of alerting users when one of the passwords they want to use with their account is already in the HaveIBeenPwned database of compromised accounts.
Meshkov stated that "we don't know what accounts exactly were accessed by the attackers. All passwords stored in AdGuard database are encrypted so we cannot check whether any of them is present in the known leaked database. That's why we decided to reset passwords of all users."
All AdGuard users have to choose a new password following the system reset and to do that they can follow the step by step instructions available on AdGuard's Reset Password page.
As an end note, AdGuard's CEO said that the company is considering to introduce two-factor authentication for all users as soon as possible to increase their accounts' security in on fell swoop.