Just saw the 3M Warframe and 700k WhitePages databases that hit the dark web over the weekend. I already know for a fact half our engineering team plays Warframe, and they 100% reuse passwords.
Management is breathing down my neck asking if we need to force a global password reset across the entire domain today. I’m hesitant because of the sheer ticket volume it’s going to generate to start the week, but the credential stuffing risk is massive right now.
What’s everyone’s move here? Are you hitting the panic button and forcing a reset, or just aggressively monitoring the logs?
14 Views
Replies (3)
Marked SolutionPending Review
Participant
2 weeks ago
Mar 23, 2026
Marked SolutionPending Review
Man, do not do this. Global resets are dead. If you force a reset today, they’re just going to change Password2025! to Password2026! and go to lunch.
Do you not have MFA enforced for VPN and critical apps? We stopped doing panic resets a long time ago. If a user gets scraped from a gaming forum, let your conditional access policies and the MFA challenge block the login attempt. Save your sanity
Marked SolutionPending Review
Participant
2 weeks ago
Mar 23, 2026
Marked SolutionPending Review
We aren’t doing a global reset, but you shouldn’t just ignore it either.
If you use Entra ID, just feed the newly breached hash list into your banned password directory. That way it catches the bad passwords at their next normal rotation. Or better yet, just run your corporate domains against the HaveIBeenPwned API. If a dev actually shows up in the dump, force reset just that specific guy. Nuking the whole org over a gaming site breach is overkill.
Marked SolutionPending Review
Participant
2 weeks ago
Mar 23, 2026
Marked SolutionPending Review
As a helpdesk manager: please, for the love of god, don’t.
It’s Monday morning and my L1 guys are already slammed with the usual weekend backlog. If you drop a surprise domain-wide reset right now, the ticket queue is going to catch fire by noon. Take amelia’s advice. Target the devs you know are gamers or send out a “highly recommended” security memo to the company.
Save
