Hexbear was a victim of a targeted XSS attack similar to the attack many other Lemmy instances have seen.
The account that first leveraged the attack was registered on 2023-07-10 at 03:58 UTC, the fix for the vulnerability was applied by around 04:35 UTC. This leaves a ~40 minute window in which anyone browsing the site could have had their account hijacked.
The attacker was able to act (post, comment, DM) as the account they hijacked. They will also have been able to view/use the compromised account's settings page. This means they will have been able to see users' email addresses. Some accounts that were compromised were temporarily banned, these bans have now been lifted.
If you were using the site during the above time window, please double check your account settings to see if anything was changed.
Passwords were not stolen, JWTs were. We have just invalidated all old JWTs so the attacker no longer has access to the hijacked accounts (this is why all users have been logged out).
shit like this is why i only register with burner emails (or, in the case of this site, no email) if possible.
Also I always use 100 character long randomized passwords that are different on each site. Overkill? Yes. would rather be overkill
There's still a bunch of sites I run into that limit password lengths. I accept there has to be some limit, but if you're just hashing it and comparing it to a known value anyway it's really negligible compared to SMS 2FA rates, checking FIDO message signatures, or using some like SQRL/Google's new thing.
Phishing sites usually don't limit password field length so I ctrl+v the entire bee movie script in there a few dozen times then hit enter over and over until I get bored when I find one.