Slack says it is resetting passwords for 1% of its users after receiving new info about the company's 2015 security breach; in April, Slack said it has 10M DAUs
Company said it received a batch of compromised credentials related to the 2015 hack via its bug bounty program.
Context & Ripple Effects
Slack's 2015 breach happened when the company had around 1.7M daily users; it now counts over 10M DAUs and more than 85,000 paying customers, meaning most of today's user base never experienced the original incident. What forced the reset this week was unusual: a batch of credentials tied to the old hack arrived through Slack's own bug bounty program rather than through internal monitoring.
The timing matters commercially because Slack's growth curve has been flattening — DAU growth had already slowed from 50% to 33% per five months back in 2016 — and because the platform holds sensitive workplace communications: since its GDPR policy update, premium customers can download entire histories, including DMs. Any story about compromised Slack credentials therefore lands on enterprise buyers' risk assessments, not just individual logins.
First-order effects
- Roughly 1% of Slack's user base gets locked out until they reset passwords, and Slack must re-verify whether the resurfaced 2015 credentials still open live accounts four years later.
- Security admins at Slack's paying customers face immediate questions about whether any of their members' accounts are in the compromised batch, given how much internal conversation history sits behind those logins.
Second-order effects
- Enterprise procurement teams gain fresh leverage in renewals and vendor reviews — a four-year-old breach producing current password resets is exactly the kind of finding that slows deals for a collaboration platform competing on trust.
- The incident validates bug bounty programs as a breach-detection channel: Slack learned about circulating credentials from a bounty submission, which pushes rivals toward funding their own programs rather than relying solely on internal telemetry.
Third-order effects
- If credential dumps keep surfacing years after the fact, SaaS vendors will face pressure to treat old breaches as ongoing liabilities — forcing shorter credential lifetimes, mandatory rotation policies, and retention limits on legacy password data.
- Bug bounties are quietly becoming part of the incident-response stack, blurring the line between researcher reports and breach notifications — a shift regulators and enterprise customers may formalize as collaboration tools become core business infrastructure.
The trend: Collaboration platforms are learning that breach liabilities compound with user growth — old incidents resurface at scale, and bug bounty programs are doubling as breach-detection channels.