When you discover unauthorized password changes, your incident response clock is already ticking. The Capcom breach, which exposed data from over 11 million accounts, included 196 instances where attackers modified login credentials. This shift from passive data exposure to active account manipulation marks a critical escalation your response protocols must address.
This checklist outlines the technical and communication steps required when managing a breach involving both data exposure and unauthorized account access. It focuses on securing compromised systems and protecting customers from further attacks.
Prerequisites
Before using this checklist, ensure:
- You have documented authority to reset passwords across affected accounts.
- Your incident response team includes representatives from security, legal, communications, and customer support.
- You've preserved forensic evidence and can contain the breach without destroying investigation artifacts.
- You have a pre-approved communication template reviewed by legal for breach notification language.
Containment and Account Security
1. Identify the scope of unauthorized access
Document which accounts show evidence of attacker-initiated changes versus those merely exposed. Look for login timestamps, IP address changes, and modification logs indicating active use.
Effective documentation: A spreadsheet with columns for accounts with confirmed unauthorized changes, accounts with suspicious activity, and accounts with data exposure only. Each category receives different treatment.
2. Force password resets on all accounts with unauthorized changes
Invalidate current credentials immediately and require users to authenticate through a separate channel before setting new passwords. If your system allowed 196 unauthorized changes, your authentication controls failed. Forcing resets removes attacker-controlled credentials.
Effective action: Affected users cannot log in with existing passwords. They receive an email with a time-limited reset link requiring identity verification through a secondary factor.
3. Enable Multi-Factor Authentication (MFA) for all affected accounts
Enable MFA for every affected account. The attacker has shown they can compromise passwords; MFA blocks them from using stolen credentials.
Effective implementation: MFA enrollment is mandatory before users can access accounts post-reset. Your system supports authenticator apps or hardware tokens, not just SMS codes. NIST SP 800-63B guidance on authenticator types.
4. Review and revoke active sessions
Terminate all active sessions for affected accounts, including mobile app tokens, browser cookies, and API keys.
Effective action: Your session management system shows zero active sessions for affected accounts after revocation. Users must re-authenticate through the full MFA flow to establish new sessions.
5. Check for lateral movement indicators
Review logs for the 196 accounts to see if attackers used them to access other systems, escalate privileges, or exfiltrate additional data.
Effective investigation: Query your SIEM for all activity from compromised accounts during the exposure window. Document which internal systems they accessed and whether they accessed data belonging to other users.
Customer Communication and Phishing Defense
6. Send breach notification within your jurisdiction's required timeframe
Customers with unauthorized password changes need immediate notification. Send urgent alerts to the 196 accounts with confirmed changes, then follow with broader notifications to the 11 million accounts with exposed data.
Effective communication: Your urgent notification goes out within 24 hours of confirming unauthorized changes. It states what happened, what you've done, and what customers must do.
7. Provide specific phishing indicators tied to your breach
Tell customers exactly what attackers know about them and what that means for phishing attempts.
Effective warning: Your notification includes a section titled "What attackers can use to target you" with specific examples, such as referencing the last login date to appear legitimate.
8. Establish a verified communication channel
Set up a dedicated subdomain with clear branding and tell customers that's where you'll post official updates. Include the URL in all notifications.
Effective setup: Register a subdomain like breach-response.[yourcompany].com with a valid TLS certificate. The page includes a timeline of response actions, FAQs, and a form for verifying communications.
9. Train your support team on breach-specific social engineering
Brief your support staff on elevated verification requirements during the breach response period.
Effective training: Your support team requires at least two forms of verification not exposed in the breach before discussing account details. They have a script for handling callers who can't pass verification.
Forensics and Prevention
10. Document the authentication bypass mechanism
Identify how attackers changed 196 passwords. Did they exploit a password reset flow, compromise an admin account, or bypass MFA?
Effective analysis: Your forensic analysis identifies the specific API endpoint, admin function, or authentication bypass that allowed unauthorized changes. Document the timeline, attacker's IP addresses, and sequence of requests.
11. Implement monitoring for password change anomalies
Set alerts for unusual password change patterns: multiple changes from the same IP, changes for inactive accounts, or changes outside normal geographic patterns.
Effective monitoring: Configure alerts that trigger when more than five passwords change from a single IP address within an hour, or when an inactive account suddenly changes its password.
Common Mistakes
Treating all 11 million accounts the same: The 196 accounts with unauthorized changes need immediate, aggressive response. The broader exposed population needs notification and guidance, but not emergency lockouts.
Waiting for users to reset their own passwords: If attackers changed passwords, they control those accounts. Force resets; user-initiated resets won't reach compromised accounts.
Sending breach notifications that read like phishing: Use clear, calm language and direct users to type your URL manually.
Enabling SMS-based MFA as your only second factor: SMS is better than nothing, but NIST SP 800-63B discourages it due to interception risks. Offer authenticator apps or hardware tokens as the primary option.
Next Steps
After completing this checklist, schedule a post-incident review within 30 days. Focus on three questions: What allowed the initial data exposure? What allowed the progression to unauthorized password changes? What delayed your detection?
Your findings should drive specific control improvements. If the breach exposed login timestamps and IP addresses because you stored them in plaintext logs, encrypt those logs. If attackers changed passwords through an admin interface without triggering alerts, add monitoring. If you discovered the unauthorized changes only after customers reported locked accounts, implement real-time password change monitoring.
The gap between data exposure and account manipulation is where your controls either hold or fail. Ensure your next incident response starts before attackers reach that second stage.
