Last week, IT Glue sent out a notice to their users, recommending that passwords should be changed due to a recent increase in suspicious login activity. Here is the notice:
Due to an increase in suspicious log-in attempts, we have leveled up security measures by enforcing a password rotation for your IT Glue user account. Please go to your IT Glue log-in page and manually request a password reset immediately. It is important to note that we have no reason to believe your account has been compromised. This is being done as an extra precautionary measure to ensure your safety.
In addition to a recent mandatory MFA setup, we also highly recommend you enable IP access control. Adversaries are constantly on the attack and it's imperative you use fundamental layers of security to ensure your credentials do not get compromised.
Lastly, if your IT Glue password is used for any other applications, we recommend you immediately reset the password for those applications as well.
We appreciate your prompt attention and thank you for your support in continually enhancing your security measures.
Notes:
1. An issue that some customers are experiencing is that after entering a new password, the site is not taking their MFA token and they cannot access their account. This is usually due to browser cache and can commonly be fixed by using a different browser, clearing cache and cookies completely, or trying an incognito window.
2. This is a one-time password rotation and not recurring.
3. For SSO users:
SSO authentication happens when users log in via yoursubdomain.itglue.com. Your IT Glue credentials are not involved when authenticating via SSO. Even with SSO enabled, users can still log in to IT Glue via app.itglue.com (app.eu.itglue.com or app.au.itglue.com for our EMEA and AU datacenter customers respectively) using their IT Glue credentials (and independent IT Glue MFA, if enabled). These URLs circumvent SSO authentication and are useful in instances such as:
An SSO provider's service is down.
An SSO certificate expires.
Users outside of your organization and SSO directory require access to IT Glue, for example, your client users or contractors.
Please go to app.itglue.com (app.eu.itglue.com or app.au.itglue.com), depending on the data center you are on and click on "Forgot Password" to reset your IT Glue password. 4. If you received email communication regarding the enforced password reset but you have already cancelled your account with IT Glue, this is because IT Glue user accounts remain in the system after cancellation should there ever be a need to reactivate them. There’s no need to action anything on your end. Our apologies for any inconvenience. If you have any questions, please contact our dedicated support line at support@itglue.com