The hacked e-mail list holds e-mail addresses that are known to be in e-mail + password lists leaked from other websites (credential stuffing). It was started on 2026-10-24 from the usernames tried in the attacks on the IPTV app login on 2026-10-01/02 and 2026-10-23/24. The list is the collection HackedEmailAddresses.
An account is stale when its login address is on the list and its password has not been changed since the address was listed (passwordChangedAt missing or earlier than addedAt). A stale account's password must be treated as known to attackers, so a correct password alone no longer logs it in:
| Where | What happens to a stale account |
|---|---|
| Portal login /auth/login (username + password) | 401 password_compromised, no token. The employee is mailed a link to the reset page (/#/reset, Set password), where a new password must be chosen. Employees whose 2-factor works - SMS with a number on the employee, or an authenticator that has been set up, switched on for the employee or forced by the customer - are not stopped here: 2-factor already stops an attacker who only has the password. 2-factor that is switched on but not set up does not exempt. |
| IPTV app login /iptv/app/login from a new device | Answered exactly like a wrong password (403 access_denied). The owner is mailed (in Danish) a link to /#/iptvreset on the reseller's portal, where a new TV password is chosen (Set password). Devices already on the account keep logging in. |
| CardDAV (e-mail + password) | Refused like a wrong password, also from the login cache and also for 2-factor employees (CardDAV never asks for 2-factor). No mail, no brute force registration. |
CardDAV also stops accepting a password once it has been changed. A phone that still has the old password is refused from the cache without brute force registration, so its polls cannot get its IP blocked.
Passkey logins, IPTV login by code/proxy, impersonation, M2M and CardDAV's persistent-token-as-password are not affected. A link is valid for 30 minutes; while one is pending no new mail is sent. A link that could not be mailed is removed again, so the next login tries again - the portal login then answers with an error (not 401 password_compromised), the IPTV login still answers like a wrong password. A new password must differ from the current one (422 password, check same). Existing sessions and tokens are not revoked.
Communicator, the mobile apps and other clients that log in with a password through /auth/login get the 401 password_compromised and cannot log in until the password has been changed through the mailed link.
Employees.passwordChangedAt (employees) and IpTvDrmAccounts.passwordChangedAt (iptvdrmaccounts) are set whenever a password is written: the reset page, a password change on the employee, an admin “reset password”, a new employee, the PBX restore (which restores the backed up value), the IPTV account page in the portal (only when the password really changes), the in-app change and the IPTV reset page. Accounts whose password was set before 2026-10-24 have no value, which counts as older than any listing. The portal shows the date on the user page and the IPTV account page.
Pending links are kept in EmployeeResetTokens (portal) and IpTvDrmResetTokens (IPTV).
Administration > Sikkerhed > Hackede e-mailadresser (ADMIN only) lists the addresses, can show only those that belong to one of our employees or IPTV accounts (with their password change date, whether they are stale and whether 2-factor applies), add a pasted list with an optional date, and remove an address. An address added again keeps the later of its two dates - a newer leak can hold a newer password.
| URL | Method | Description |
|---|---|---|
/admin/hackedemails | GET | ?filter=&matched=true&offset=&limit= (limit max 500). Returns { total, items }; each item has _id (the address), addedAt, employee (_id, name, customer, customerName, passwordChangedAt, twoFactor, stale - twoFactor is 2-factor that works) and iptv (username, customer, customerName, passwordChangedAt, stale), each null when there is none. |
/admin/hackedemails | POST | { addresses: [..], addedAt?: ISO date } (addedAt defaults to now; a date in the future is refused, 422 addedAt). Returns { added, updated, unchanged, invalid, invalidCount }. |
/admin/hackedemails/:address | DELETE | Removes the address; 404 when it is not listed. |
All three need access level ADMIN (403 access_denied otherwise).
/#/iptvreset on the reseller's portal is public and calls POST /iptv/app/setpassword with the token from the link. A successful change is written to the change log as “Security: new password chosen through the hacked e-mail link”.