Please or to access all these features

Site stuff

Join our Innovation Panel to try new features early and help make Mumsnet better.

See all MNHQ comments on this thread

Due to a security breach we are resetting all passwords across Mumsnet

729 replies

RebeccaMumsnet · 12/04/2014 17:32

Following the recent security breach related to Heartbleed we are reseting the passwords of all users.

On Saturday 12 April, we will remove all passwords from our system and to use the site, you'll need to reset your password by clicking on the password reset link.

Type in your email address and click the 'Request reset' button and you will receive a mail to your Mumsnet registered email account. (You will need to click on the link in the mail within 30 minutes of receiving it, without changing the device you're using i.e swapping from phone to laptop, or you'll need to request a further reset).

If you do not receive a mail, please check you spam folder. The password reset mail will come to the email you used when you first registered with Mumsnet.

If you don't receive or can't access your reset mail, please [email protected] for help.

We are very sorry for all the fuss. We want to assure you that we followed all the published steps to protect members' security as soon as we became aware of the heartbleed security risk, but it seems that the breach occurred prior to that risk becoming known.

Most importantly, if you use the same password here as elsewhere, we strongly recommend you change your password on the other sites too.

Thanks,

Justine & the MNHQ team

OP posts:
Quinteszilla · 12/04/2014 22:42

Hang on, have we gone back to 2011? Thats the last time I saw psychomum. Hurra, we have a password reset time machine (without a password reset!)

RowanMumsnet · 12/04/2014 22:41

@Maryz

Bump Quint up to the top of the "posters who need a reply queue will you?

[ingratiating Smile]

We honestly don't know why the reset emails aren't getting through!

psychomum5 · 12/04/2014 22:39

Happy to say it all worked for me......thanking all that is holy right now as I originally registered with an email that got hacked, and I wasn;t sure which email I then used when re-setting things before.

ANYWAY.....all is done

ExcuseTypos · 12/04/2014 22:37

Just to say I've changed my password without any problems.

This has also promoted me to change all passwords on other websites. So thank you for highlighting all this. Flowers

Maryz · 12/04/2014 22:35

This reply has been deleted

Message withdrawn at poster's request.

Quinteszilla · 12/04/2014 22:35

My Facebook is all riot, with birthday celebrations of my friends cats tonight! Shock I cant mix these two worlds!

Quinteszilla · 12/04/2014 22:34

But I dont WANT you mixed up in my Facebook!

Quinteszilla · 12/04/2014 22:34

Maryz Grin It is all up to MNHQ!

noblegiraffe · 12/04/2014 22:33

The alarming thing here is that MN was apparently hacked before heartbleed went public. So someone knew about it and used it before the general public were alerted.

We only know MN was hacked because the hacker was kind enough to let us know. That at least one person was hacking before the vulnerability was general knowledge and was patched up means that other vulnerable sites like gmail and Facebook may have been hacked too, before the updates, and without us knowing about it. People need to change their MN password, but even those who use other passwords for other things need to be changing those too, not just those they use their mn password for.

RowanMumsnet · 12/04/2014 22:31

@pepperrabbit

I'm very confused Sad I didn't get the reset email at all and contacted MN via the contactus@mumsnet email address. Tried my old password and everything. Just received the generic email and haven't a clue if my email address is the one I registered with as it was over 8 years ago (as it's DS2's 8th birthday and I was def on an antenatal thread when he was a bump!) Anyhow, I just got back in by pressing the "Log me in via Facebook" button, and voila - no password needed - straight in.. Confused and slightly Shock

Yup, Google and Facebook log-in will get you around re-setting your Mumsnet password; we still know it's 'you' because the email address you used for signing up to Google or Facebook gets cross-checked with your registered MN email address.

Maryz · 12/04/2014 22:28

This reply has been deleted

Message withdrawn at poster's request.

HarveySchlumpfenburger · 12/04/2014 22:26

Moln, I changed almost all of mine last weekend routinely. I could have cried when I saw that article on this earlier in the week.

Quinteszilla · 12/04/2014 22:25

I think I will look upon this as a game of Russian Roulette. I have waited 30 minutes for my email. If it does not arrive, then my MN days will be over the next time I am logged out. Grin Will do me good.

Moln · 12/04/2014 22:24

I'm not going to be able to remember all these new passwords

It's bad enough I have to have 500 different passwords in work

Sad
pepperrabbit · 12/04/2014 22:22

I'm very confused Sad
I didn't get the reset email at all and contacted MN via the contactus@mumsnet email address. Tried my old password and everything. Just received the generic email and haven't a clue if my email address is the one I registered with as it was over 8 years ago (as it's DS2's 8th birthday and I was def on an antenatal thread when he was a bump!)
Anyhow, I just got back in by pressing the "Log me in via Facebook" button, and voila - no password needed - straight in.. Confused and slightly Shock

RowanMumsnet · 12/04/2014 22:21

@Quinteszilla

Do we need to make the change even if we have changed the passwords after the security breach? I changed mine yesterday.

Yes, sorry - as of about 5pm every single user's password was wiped.

You can log in to your MN account via Facebook or Google (without changing your MN password) if you have accounts there (because those use your FB/Google passwords) - but of course best current advice is to change ALL your passwords, just as a word of warning...

Maryz · 12/04/2014 22:20

This reply has been deleted

Message withdrawn at poster's request.

HarveySchlumpfenburger · 12/04/2014 22:18

I think so Quinteszilla. As far as I know they've just removed all the passwords that were current after this afternoon's security issue. My old password was the one I changed to last night.

noblegiraffe · 12/04/2014 22:16

I suppose if they had access to Justine's account that might have given them access to everything?

cozietoesie · 12/04/2014 22:16

If you're logged in, you can see whatever details are in the account profile - but they're pretty darned limited even so. There's far more out there on you on other and open systems.

NearTheWindymill · 12/04/2014 22:10

So, it's our Mnet nickname(s), internet password that might be published. Not our r/l name - is that right. Can the two be linked please?

Quinteszilla · 12/04/2014 22:08

Do we need to make the change even if we have changed the passwords after the security breach? I changed mine yesterday.

RowanMumsnet · 12/04/2014 22:08

@eatyourveg

Trying to change the password on my account, type in my old password which I kept having to use to log in with yesterday but its now saying it doesn't recognise it! Confused How can I change it if I don't know what it is to start with?

If you log out completely you'll be prompted to ask for a password reset link (without having to input your password)

Keepcalmanddrinkwine · 12/04/2014 22:08

I came on the ask the same question as eatyourveg. I'm still logged in though, which is a good thing.
:)

Gruntfuttock · 12/04/2014 22:08

eatyourveg the old passwords have been deleted, you just need to enter a new password.