The Post Millennial Data Breach and Leak Hits 26 Million Accounts

The Post Millennial, a conservative news outlet, was subjected to a significant data breach and subsequent data leak. This event compromised the personal information of millions, including hundreds of the site's writers and editors, as well as a large number of subscribers.

The breach occurred on May 2, 2024, and was confirmed by Have I Been Pwned (HIBP) on May 10. The attackers not only accessed and leaked data but also defaced the website, posting a fake letter and links to download the stolen data. The leaked data includes sensitive personal information:

• Writers and Editors: IP, physical addresses, and email addresses were exposed.
• Subscribers: Names, emails, usernames, phone numbers, and passwords in plain text were compromised.
• Mailing Lists: Tens of millions of email addresses from several thousand mailing lists were leaked, though the affiliation of these lists with The Post Millennial has not been independently verified.

The total number of compromised accounts tallies up to 26,818,266, however, it has not been confirmed if all the records belong to Post Millennial subscribers. HIBP mentions it's possible that a portion of the data dump was taken from third party email marketing service providers.

The attack was first noticed when The Post Millennial and its sister site, Human Events, were taken offline by the hackers. The attackers replaced the homepage with a fake “coming out” letter purportedly from Post Millennial senior editor Andy Ngo, rebranded as “Angelina Ngo” in the letter, and used this as a segue to announce the data leak.

Both sites were briefly taken down, and their Twitter accounts were made private, either as a protective response by the owners or potentially by the hackers themselves. The defaced content and hacker's note were removed within an hour, replaced by a maintenance message.

Soon, it became clear that the incident wasn't limited to just website defacement. The attackers linked to data dumps that were downloaded by an undetermined number of users, who later shared them on hacking forums and torrent sites.

For users affected by this breach, it is crucial to change passwords and monitor accounts for any unusual activity. Unfortunately, the exposed information contains sensitive data that cannot be reset, such as home locations, so the impact of this incident is particularly severe.