Why did I get an email about Leaked Account Details?
The Queen’s IT Services Security team recently became of the following. In November 2023, a post to a popular hacking forum alleged that millions of LinkedIn records had been scraped and leaked. On investigation, the data turned out to be a combination of legitimate data scraped from LinkedIn and email addresses constructed from impacted individuals' names. According to reports, the breach included Email addresses, Genders, Geographic locations, Job titles, Names, Professional skills, Social media profiles. If you were directly notified by IT Services in an email about this breach, then your Queen's email address was included in the list of accounts that were part of this breach. As a precaution, Queen’s IT Services will expire the passwords of any Queen’s account found to be listed on the breached accounts list to ensure that the password posted will no longer be valid.

What should I do to protect myself?
If you received an email message from IT Services concerning the posting of your information, you will be sent additional emails requesting you to change your password, prior to your password expiring. NetID passwords are changed at https://netid.queensu.ca/selfservice/login/auth

We also encourage you to take the following actions to better protect yourself and your information:

Do not reuse passwords across your accounts.
If you have used your Queen’s password on multiple sites, we strongly encourage you to change that password on every other site where it has been used.
Be extra diligent of scams that may reference your Queen's account.

What data was compromised?
According to reports, the breach included Email addresses, Genders, Geographic locations, Job titles, Names, Professional skills, Social media profiles.

Why is Queen’s expiring passwords for potentially breached accounts?
Queen’s account holders who fail to follow safe password practices are at risk when breaches like this occur. To protect your Queen’s account IT Services are taking this action to prevent account compromises by ensuring all accounts associated with the posting of credentials have refreshed passwords.

What caused the data breach?
It is believed that data like this is obtained from the scaping of data from breaches and from the mining of other 3rd party breached data which has been posted online in the past. Account information obtained through other online service breaches are reviewed by hackers and when simple passwords are found, they are tested against other services to see whether the password is still valid with slight variations. IT Services obtain breach information from the service called “Have I Been Pwned?” . Visiting the website https://haveibeenpwned.com/ will allow you to enter and check your Queen’s University email address against all publicized breaches that reference your Queen’s email address. The site also provides details about the data breach, including links to additional information.