From: security@washingtonpost.com To: [your email] Subject: Washington Post Vulnerability Update Dear [name], Our initial investigation revealed that

From: security@washingtonpost.com To: [your email] Subject: Washington Post Vulnerability Update Dear [name], Our initial investigation revealed that an unauthorized third party managed to retrieve the list of user IDs and email addresses associated with Washington Post Jobs accounts, of which yours was one. Our security team has performed a more thorough audit of the attack which resulted in the exposure of your information and has determined that the unauthorized third party was also able to gain access to encrypted passwords. Because the passwords were encrypted, it is unlikely that the attackers will be able to access your Jobs account. However, due to the very small chance that this unauthorized third party may be able to decrypt your password, we are requiring every Jobs account holder to change their password within the next 48 hours. Failure to change your password will result in your account being permanently locked out. To further enhance the security of our Jobs site, you will need to specify your existing password as well as your new password. Your new password must be at least eight characters long and have one or more upper case letters, one or more lower case letters, and one or more numbers or symbols. Please change your password at the following URL: [link to phishing site that looks like Washington Post's Jobs site with a realistic password change form that will dutifully accept your email and current password and enforce the new password requirement for good appearances] Sincerely, Washington Post Jobs Customer Service