eksployted

That's what I was hoping, but I tested it.

Used a VPN endpoint in a country that would surely get blocked. Attempted to login with wrong password, did not receive email. Logged in with correct passphrase, received email. Both scenarios looked the same on the login screen, so there wasn't any indication that I logged in with the correct password if I were the attacker

edit: last night they released something that says they sent some of those emails in error. I hope that is the case, but it's still not very re-assuring. I went through and changed all of my financial/critical accounts yesterday in precaution, today my bank account was locked out from brute force. Could be a coincidence, but that is the first time it's ever happened with that account

happened to me too, the only one there I have is uBlock origin, matched what somebody also had. Hard to imagine it's ublock origin though because it has so many users.

The only ones I have that match up there are EditThisCookie and ublock (origin)

EditThisCookie was last updated November 22, 2020, so it doesn't seem likely from that.

ublock origin was updated December 2, 2021, but they haven't changed devs or anything that would make me suspicious.

That's possible, but the audit log shows the event that triggered the email and failed logins as two separate things.

The events are "failed login" and "Login verification email sent". The second one is what triggered the email and this event seems like it should only happen if you correctly login but their additional checks stop it from authenticating completely. The email has a button for "verify new device or location", which sure makes it seem like the login was successful.

I hope they just mangled up their event logger and it really should have been a failed login attempt but was logged as a valid login and triggered the email.

In theory eSIMs should make that easier (when all networks support it). They can store multiple numbers/sim cards which you can switch on the fly.

My account was created in 2013 and changed the password last in 2016. I went back and looked in the audit log for the last year and there was nothing else suspect. Just some failed logins, but that's pretty common, I didn't see any logged in usage from any IPs but mine

Sure, this is the email

Time Tuesday, December 28, 2021 at 6:20 AM EST Location GERMANY IP address 160.116.206.37

I don't think that's the case. I went back and looked at the auth logs and there are many "failed logins" and one "Login verification email sent", which is the only one I got an email for.

Mine was similar

Time Tuesday, December 28, 2021 at 6:20 AM EST Location GERMANY IP address 160.116.206.37

I also just had this happen as well and have the same setup. Unique password stored in keepass-x and I use the chrome extension. I have very few installed though, so hopefully not a malicious one there.

installed extensions: ublock origin, OneTab, Lastpass, metamask, cisco webex, edit this cookie

I just had this happen to me as well. I don't use the password anywhere else and I also have it stored in keepass-x