Leaked Credentials Runbook

Leaked Credentials Runbook

Use this when an NFE password, app password, API key or SSH key may be known to someone else. It was written after the 2026 mailbox compromises.

Important: at NFE, one LDAP password unlocks Nextcloud, IMAP/SMTP mail and Roundcube webmail. A leaked mail password is a leaked Nextcloud password, and for members of admins, a leaked admin password.

1. Contain (first hour)

1. Change the password from a device you trust. Use a new, random, unique password from a password manager.
2. Nextcloud → Personal settings → Security → Devices & sessions:
   • revoke every session and app password you don't recognise;
   • when in doubt, revoke them all and re-create the ones you need.
3. Mail settings: check for anything you didn't create.
   • Nextcloud Mail → Account settings → Filters and Autoresponder.
   • Roundcube → Settings → Filters / Identities / Responses.
   • Look for forwarding, redirect or vacation rules and extra identities.
4. Ask the Security DRI to ask Federated Computer to:
   • confirm the account is no longer sending;
   • pause outbound mail for it if it still is;
   • share SASL/Roundcube login logs (source IPs, times).

2. Find how it leaked

• Reuse: was the same password used anywhere else? Check haveibeenpwned.com for your NFE address.
• Infostealer: were passwords saved in a browser or mail app on a device that could be infected? Scan it, and change every password saved on that device.
• Phishing: did you type the password into a page reached from an email link?
• Exposure: was it pasted in chat, email, a file, a screenshot or code?

3. Clean up

• Delete (with the Security DRI's agreement) any mail or file that contains the old password, e.g. "SMTP checker" bounces.
• Rotate anything that was shared alongside it (shared accounts, API keys in the same note).
• Update every legitimate device with its own app password. See Accounts, 2FA and App Passwords.

4. Record

Open an incident record and, when closed, add a report to Incident Reports.