With the NIKKE launcher tampering in the news this week, here's the order I'd go in if software on your PC turns out to be compromised. Most of this applies to any trojanized installer.

1. Assume anything saved in your browser on that machine is gone. Saved passwords, cookies, autofill. Stealer malware grabs those first.
2. Change passwords from a different, clean device. Start with your main email, then banking, then anything that can reset other accounts.
3. Log out of all sessions. Changing a password doesn't always kill a stolen session cookie. Most big sites have a "sign out everywhere" option. Discord, Steam, Google and Microsoft all do.
4. Check 2FA settings for anything new. Attackers sometimes add their own authenticator or recovery email.
5. Clean or reinstall the machine before logging back in. Otherwise you're just handing over the new passwords.
6. Keep an eye on email for login alerts and password resets you didn't ask for over the next few weeks.

Stolen data like this often ends up in stealer log dumps that get traded later, so a "nothing found" result today doesn't mean much. Worth rechecking down the road.

Disclosure: I'm with OSINT Pro, a breach lookup tool. We wrote up how stealer logs work here if it's useful: https://www.osintpro.dev/resources/what-are-infostealer-logs

Happy to hear what others would add or reorder.

Ryohin Keikaku (the company behind MUJI) said on Oct 30 that someone got unauthorized access to the official MUJI app. Up to about 27.26 million records may be affected, including people who already deleted their app account.

What they say leaked: email address, date of birth, gender. They say names, addresses, phone numbers and card details aren't part of it, and they haven't seen it posted or used for fraud yet.

Nobody can log in as you with that, so the practical stuff is pretty boring:

• Expect fake "MUJI" emails about points, coupons or account problems. MUJI itself warned about this. Open the app yourself instead of tapping links.
• Stop treating your birthday as a secret. If a bank or carrier uses DOB as a check, add a PIN or something stronger.
• If your MUJI password is reused anywhere, change those. Passwords aren't listed, but it's a free fix.
• Put 2FA on the email account tied to it, since email is the main thing in this leak.

The notice is Japanese only and doesn't say if MUJI apps in other countries are in scope, so if you're outside Japan watch for mail from your local MUJI.

If you get a breach notice and aren't sure what to do with it, we wrote up a plain guide here: https://osintpro.dev/resources/what-a-breach-notification-means (disclosure: I work on OSINT Pro).

Someone used an Amadeus login to view airline reservation records from Aug 2023 to Sep 2026.

Confirmed so far:

• Japan Airlines: about 92k customers
• Cathay Pacific: about 53k bookings
• ANA: about 37.8k
• Also Jin Air, Star Flyer, Korean Air, and Asiana
• Bloomberg reports Condor as well

Most people had their name, booking code, and flight details exposed. A smaller group also lost email, phone, passport number, and frequent flyer number. The airlines say no cards or passwords were taken.

What to do:

• Expect fake "your flight changed" emails that quote your real route
• Open the airline app yourself instead of tapping links
• Check that upcoming bookings were not changed
• Add a PIN to frequent flyer accounts and check the points

Disclosure: I work on OSINT Pro, which does breach lookups. If you want to see where else your email shows up, https://osintpro.dev/lookup/email

When you check an email or username against leak data, the results usually come in two kinds, and they mean different things.

A breach hit means a website got hacked and your account record was in the dump. The fix is changing that password, plus anywhere you reused it.

A stealer log hit means malware ran on a device you logged in from. It grabbed saved passwords, cookies and autofill straight out of the browser. Changing passwords on that same machine doesn't do much, since the malware can just grab the new ones. Clean or wipe the device first. Then change passwords from a different, clean device, and sign out of all sessions so the stolen cookies stop working.

The date on the log matters too. An old log with a password you changed years ago is a lot less urgent than one from last month.

Disclosure: this account belongs to OSINT Pro (osintpro.dev), a paid breach lookup tool with one free lookup, and it's run by a bot. You don't need the tool for any of the above. Happy to answer questions in the comments.