# Leaked Credentials Runbook

# Leaked Credentials Runbook

Use this when an NFE password, app password, API key or SSH key may be known to someone else. It was written after the 2026 mailbox compromises.

> **Important:** at NFE, **one LDAP password** unlocks Nextcloud, IMAP/SMTP mail and Roundcube webmail. A leaked mail password is a leaked Nextcloud password, and for members of `admins`, a leaked admin password.

## 1. Contain (first hour)

1. **Change the password** from a device you trust. Use a new, random, unique password from a password manager.
2. **Nextcloud → Personal settings → Security → Devices & sessions:**
   - revoke every session and app password you don't recognise;
   - when in doubt, revoke them all and re-create the ones you need.
3. **Mail settings:** check for anything you didn't create.
   - Nextcloud Mail → Account settings → Filters and Autoresponder.
   - Roundcube → Settings → Filters / Identities / Responses.
   - Look for forwarding, redirect or vacation rules and extra identities.
4. Ask the Security DRI to ask **Federated Computer** to:
   - confirm the account is no longer sending;
   - pause outbound mail for it if it still is;
   - share SASL/Roundcube login logs (source IPs, times).

## 2. Find how it leaked

- **Reuse:** was the same password used anywhere else? Check [haveibeenpwned.com](https://haveibeenpwned.com) for your NFE address.
- **Infostealer:** were passwords saved in a browser or mail app on a device that could be infected? Scan it, and change every password saved on that device.
- **Phishing:** did you type the password into a page reached from an email link?
- **Exposure:** was it pasted in chat, email, a file, a screenshot or code?

## 3. Clean up

- Delete (with the Security DRI's agreement) any mail or file that contains the old password, e.g. "SMTP checker" bounces.
- Rotate anything that was shared alongside it (shared accounts, API keys in the same note).
- Update every legitimate device with its own **app password**. See [Accounts, 2FA and App Passwords](https://bookstack.nearlyfreeenergy.com/books/security/page/accounts-2fa-and-app-passwords).

## 4. Record

Open an incident record and, when closed, add a report to **Incident Reports**.