Hackers are increasingly using stolen credentials to carry out attacks. It is also common for these credentials to be published in databases that anyone can access . For this reason, TripAdvisor has decided to revoke the passwords of members whose email or password has been found in publicly leaked databases .
A few days ago, a member of the site received an email from TripAdvisor.com that he thought was a phishing attack. The message stated that the user's email address and password were found on a list of exposed passwords. As a result, the company is invalidating their password and a new one will need to be created before the user can log back into the site.
The user who received the email was rightly concerned. We've heard of phishing attacks many times, in which hackers use such tricks to trick users into stealing personal information or leading them to malicious pages. However, in this case, it was a legitimate email from TripAdvisor. The company decided to cancel the compromised passwords to prevent a member's account from being compromised.
The so-called “credential stuffing” attack is a type of attack in which hackers collect credentials that have been leaked online and in databases, and use them to gain access to other sites.
Given that many people use the same password for all their accounts, TripAdvisor's policy to protect its members sounds good.
In the event that a user receives an email from the company, they should follow the instructions and create a new password at https://www.tripadvisor.com/MemberForgotPassword.
The email TripAdvisor sends to members whose passwords are exposed is as follows:
