Got hit with 47 password reset emails in one night and that's when I knew something was wrong
Last Tuesday I woke up to 47 emails saying my accounts needed a password reset, all between 2am and 4am. At first I thought it was spam, but then I noticed 3 of them were for accounts I actually use, like my bank and my work login. Turns out someone had my email and password from an old breach in 2019 and was running what a friend called a credential stuffing attack. I spent that whole morning changing passwords and turning on 2FA for everything, and honestly the scary part was how many sites still let you log in with just a password and nothing else. Has anyone else dealt with a flood of reset emails like this, and did you figure out where they got your info?