Forum Discussion

racerx_2502's avatar
racerx_2502
New Contributor
7 months ago
Solved

Did 1Password get hacked? The Disney Employee said hackers got into his 1password account.

Hey Folks, Decade+, happy 1password user here, however, my underpants clenched up when I read this on the WSJ today A Disney Worker Downloaded an AI Tool. It Led to a Hack That Ruined His Life. - W...
commentary
security tips
  • 1P_Blake's avatar
    1P_Blake
    7 months ago

    Hey everyone! I totally understand why this story raised concerns, but I'd like to assure you that 1Password was not hacked and remains secure. 

    In this particular case, the attacker compromised the individual’s local device. They intercepted his password using a keylogger, which allowed them to log into 1Password. Once a device is compromised, an attacker has nearly unrestricted access. 

    To help protect against attacks that target compromised devices, we recommend:

    • Ensure device integrity — keep your devices free from malware by installing security updates, enabling built-in security features, and using endpoint protection tools that actively detect and prevent threats.
    • Trust only verified sources — download software exclusively from trusted providers. Avoid unverified applications that could contain hidden malware.
    • Strengthen authentication for critical accounts —use phishing-resistant authentication methods like hardware security keys (e.g., YubiKey) or a separate authenticator app to reduce the risk of credential compromise.
    • Limit exposure from browser extensions — review and disable unnecessary or untrusted extensions, as they can introduce vulnerabilities that attackers may exploit.

     

    For more details on how 1Password protects information on your devices (and when it can’t), I would recommend reading our blog linked below. 👇

    🔗 How 1Password protects information on your devices (and when it can’t)

prime's avatar
prime
Dedicated Contributor
7 months ago

Why do they need to respond? The guy downloaded something he shouldn’t have. Once an attacker gets control over your computer, nothing, even 1Password, can save you. This is why you need to pay attention what you’re installing on your computer. 

2FA on his 1Password account wouldn’t have saved this person, because the 1Password is on the computer. 2FA is only needed when the app is 1st installed. 

scottC28773's avatar
scottC28773
New Contributor
7 months ago

To JAC3467

I'll try to explain.

I trust 1Password (the product and the people) and I don't think they "need" to respond because, as you said, the article didn't say the hacker was able to crack 1PW.

But as someone who tries to be careful, I'd like to hear the experts at 1PW tell me /us what it really means to "be careful" about what you download from the Internet. What exactly does that mean?  

I think I'm careful. Apple has built in virus detection and I have malware detection on my laptop. I've set 1PW to open with Touch ID on my laptop and face recognition on my iPhone. Does this qualify as "paying attention" or "being careful"?

If you have an answer, I'd honestly love to hear it but I also think hearing it from the professionals at 1PW would be appreciated but they don't "owe" it to us.




  • prime's avatar
    prime
    Dedicated Contributor
    7 months ago

    My set up:

    I have 3 users for my MacBook. I have an Admin side where never use and the other 2 users for just Standard users (work and personal), so they don’t have any admin rights. 

     I have the free version of MalwareBytes that I run once a day at least. I have AdGuard (life time) to block ads and has a pretty cool DNS settings that some options help prevent malware. 

    I also use the Screen Time settings to put a PIN so my account settings has an extra later (I honestly don’t know if it will work, but why not?) 

    If you’re interested in the AdGuard Lifetime, I can send you a link where go to (many people on Reddit got it from here and where I got the idea from). 

    • scottC28773's avatar
      scottC28773
      New Contributor
      7 months ago

      Thanks prime 

      Thanks for the offer on AdGuard. I don't have AdGuard but I have other utilities that limit ads to the point that I'm not bothered by them. The latest version of Safari has an interesting feature that allows me to click on an element on a webpage and remove it. Poof -- it goes away. 

      I use CleanMyMac to scan for bad stuff but not as often as I should.

      Thanks again for your reply.