Subject: Notice of Security Incident Involving Account Credentials
Date: [YYYY-MM-DD]
Incident Reference: [INC-XXXX]
Summary
We are notifying you of a security incident that involved account credentials associated with your [Organization/Product] account. Our investigation indicates that an unauthorized party obtained access to a system storing authentication data. We took immediate steps to contain the incident, protect accounts, and prevent further unauthorized access.
What Happened
- Date discovered: [YYYY-MM-DD HH:MM UTC]
- Incident window: [Approximate start/end or “under investigation”]
- Affected system(s): [System name or functional description]
- Method of access: [e.g., compromised API key, vulnerability in third-party component, credential stuffing]
- We engaged an independent digital forensics firm and activated our incident response plan upon discovery.
What Information Was Involved
Based on current findings, the following data may have been exposed:
- Account identifiers: [email/username/customer ID]
- Password data: [hashed and salted passwords using <algorithm, e.g., bcrypt/Argon2> with a cost factor of ; no plaintext passwords are stored]
- Session and authentication artifacts: [e.g., OAuth tokens, refresh tokens, session cookies, password reset tokens]
- Multi-factor authentication (MFA) data: [e.g., TOTP seeds/recovery codes] (if applicable)
No payment card information, government ID numbers, or sensitive personal data were stored in the impacted system. If this changes as the investigation progresses, we will update this notice.
Actions We Have Taken
- Containment: Isolated affected systems and blocked the unauthorized access path.
- Credential protection: Invalidated passwords, sessions, and tokens potentially exposed; enforced password reset at next login.
- MFA protection: [Rotated TOTP seeds/recovery codes and required MFA re-enrollment] (if applicable).
- Hardening: Patched vulnerabilities, rotated keys/secrets, increased logging and anomaly detection, and implemented additional rate-limiting and geo-velocity controls.
- Investigation: Working with a third-party forensics firm and notifying law enforcement and relevant regulators as required.
What You Can Do Now
- Reset your password: If you have not already done so, create a new, unique password for your [Organization/Product] account. Do not reuse passwords from other sites.
- Update reused passwords elsewhere: If you used the same or similar password on other services, change those passwords immediately.
- Re-enroll MFA: Complete MFA re-enrollment if prompted. If you were not using MFA, enable it now.
- Review account activity: Check recent logins, security settings, API keys, and authorized devices/applications. Revoke any unfamiliar tokens or sessions.
- Be alert for phishing: We will not ask for your password or MFA codes by email, SMS, or phone. Verify messages originate from [official domain].
- Developer accounts and integrations: Rotate API keys, client secrets, and webhooks. Update CI/CD secrets and invalidate cached credentials in build pipelines.
Current Assessment of Risk
- The primary risk is account takeover via credential misuse or reuse on other services (credential stuffing).
- If MFA seeds or recovery codes were exposed, there is increased risk to MFA-protected accounts until re-enrollment is completed.
- We have no evidence at this time of unauthorized activity within your specific account; however, monitoring is ongoing.
Ongoing Improvements
- Password storage: Validating configuration of [bcrypt/Argon2] with strong parameters and implementing server-side peppering.
- Access controls: Strengthening IAM policies, least privilege, and periodic secret rotation.
- Detection and response: Expanding telemetry, anomaly detection models, and 24/7 alerting and response runbooks.
- Third-party risk management: Validating supplier controls and incident notification SLAs.
Support and Contact
- Dedicated incident support desk: [email@domain.com], [phone], available [hours and timezone]
- Data Protection Officer (privacy inquiries): [DPO name], [DPO email], [postal address]
- For security researchers or additional technical details: [security@domain.com or PSIRT alias]
Please reference Incident [INC-XXXX] in your communications.
Regulatory Information and Your Rights
Depending on your location, you may have rights under applicable data protection laws (e.g., GDPR, CCPA/CPRA). These may include the right to access, rectify, erase, restrict, or object to processing of your personal data, and the right to lodge a complaint with your supervisory authority. To exercise your rights, contact [privacy portal URL or DPO contact]. We are providing this notice within the timelines required by [insert applicable laws/regulations], based on our current understanding of the incident.
Key Dates (to be updated as the investigation proceeds)
- Detection: [YYYY-MM-DD]
- Containment: [YYYY-MM-DD]
- Password and token invalidation completed: [YYYY-MM-DD]
- Regulator notification: [YYYY-MM-DD], [Authority name]
- Law enforcement report: [YYYY-MM-DD], [Agency, case number if available]
We regret this incident and are committed to protecting your information. We will provide updates at [status page URL or email updates] as our investigation progresses.
Sincerely,
[Name]
[Title, e.g., Chief Information Security Officer]
[Organization]
[Contact details]
