The Apache team was nice enough to be pro-active and send me an email alert: You are receiving this email because you have a login, '...', on the Apache JIRA i

The Apache team was nice enough to be pro-active and send me an email alert: You are receiving this email because you have a login, '...', on the Apache JIRA installation, https://issues.apache.org/jira/ https://issues.apache.org/jira/ On April 6 the issues.apache.org server was hacked. The attackers were able to install a trojan JIRA login screen and later get full root access: https://blogs.apache.org/infra/entry/apache_org_04_09_2010 https://blogs.apache.org/infra/entry/apache_org_04_09_2010 We are assuming that the attackers have a copy of the JIRA database, which includes a hash (SHA-512 unsalted) of the password you set when signing up as '...' to JIRA. If the password you set was not of great quality (eg. based on a dictionary word), it should be assumed that the attackers can guess your password from the password hash via brute force. The upshot is that someone malicious may know both your email address and a password of yours. This is a problem because many people reuse passwords across online services. If you reuse passwords across systems, we urge you to change your passwords on ALL SYSTEMS that might be using the compromised JIRA password. Prime examples might be gmail or hotmail accounts, online banking sites, or sites known to be related to your email's domain, gmail.com.