Urgent: Possible Account Compromise + Unexplained Logouts & System Issues

Hello Bitwarden Community,

I’m facing a critical and bizarre situation with my Bitwarden account and devices, and I’d appreciate any insights or help.

Timeline of Events (GMT-3):

  • June 2–3: My Windows 11 machine began acting strangely (sluggish, taskbar/Defender vanishing) despite a fresh reinstall.
  • June 3: Set up a brand-new MacBook Pro M4 [sealed], logged into Bitwarden, and was immediately logged out.
    • Attempts to relogin failed (password rejected).
    • Simultaneously, I was logged out of all devices: iPhone 15 Pro, Galaxy S10e [old backup phone], and the Windows PC.
  • Bitwarden Support responded that no account exists under my email—despite active use hours prior and login logs since 2023.

Key Concerns:

  1. Account Access:
  • Is it possible for an attacker to change the email linked to a Bitwarden account? (I use 2FA via Google Authenticator.)
  • No login alerts or unauthorized access emails were received.
  1. System Anomalies:
  • Windows 11 (fresh install): Brave browser flagged as “unsafe” by Google; odd plugin behavior (details here).
  • New MacBook: Same Brave issue; switched to Chrome/Safari as workarounds. Brave browser flagged as “unsafe” by Google
  • Now migrated to Ubuntu 24.04 for safety. (did not installed Brave Browser here)
  1. Data Points:
  • I have:
    • Physical copy of my master password and email (which is not working)
    • Historical Bitwarden emails confirming account existence (support verified .com server logs).
  • I didn’t have a full emergency backup (lesson learned).

Questions:

  • Has anyone experienced forced logouts or account disappearance like this?
  • Could a browser-plugin attack (e.g., Brave/Bitwarden extension) explain this?
  • Any way to recover the account if email was changed maliciously?

Support Ticket Update:
The agent’s response (no account found) contradicts my email records. I’ve provided all details but suspect automated replies.

Thanks for any help—this is deeply unsettling. I’ll share updates as I troubleshoot.

Can you log into the web vault (and be sure it’s the right one, either US or EU, they are different). If you are in the US and inadvertently tried logging into the EU one (or vice-versa) that would explain the “no account found” issue.

1 Like

If you have historical Bitwarden emails, you can confirm from them your account’s email address and the server it is/was on.

You can confirm if an account still exists with the same email on that server. Just by trying to register a new account on the same server with the same email.

If you are able to register it means one of two things:

  • your previous account’s email was changed
  • your previous account was deleted

If you had a json export or saved the client_id from your account’s API Key you would have your account’s internal ID.

If you do not have these, that ID can also be found on the vault cache file from a client where you previously had logged in (even if the accounts are logged out right now).

AFAIK, that ID can not be changed for an account.

In that case you could ask support if they are willing to tell you if that account ID exists on your server (to find out which of the two previous things happened: account email change or account deletion).

But I don’t know how could you convince support to give you that information.

1 Like

If you have a data.json file from a desktop client, this is one command to find out the account IDs that have previously been logged in on that client:

jq -r '.global_account_accounts | keys | .[]' < data.json

3 Likes

@youtube.4fun Welcome to the forum, and sorry that it had to be under such circumstances.

One simple scenario that may explain all of your symptoms would be of a bad actor gained access to your email account, and used this access to delete your Bitwarden account (and subsequently covered some of their tracks, such as deleting the Bitwarden email message that had the account deletion link).

My suggestions would be to:

  1. Do whatever you can to determine whether there may have been unauthorized access of your email account.

  2. Ask Bitwarden support whether they can find any records indicating that your account was deleted. If your account did exist on June 2, then Bitwarden should have access to PITR transactional logs that would show whether an account deletion occurred on June 3.

1 Like

Thanks for your message.
Yes, it was tested already, I have created mine on .com server.
But as for double-checking, tried logged in on EU server as well.
Both

Super thanks for your detailed response.

How can I do this JSON thing to extract the file from the desktop client?

Even tho, the desktop client that had Bitwarden installed was formatted by me Yesterday due to behaving really odd.

Now I understand that Ideally I should booted with my Ubuntu USB then locate this JSON thing to recover the account, correct?

Thanks in advance
Best
R

What was the result of testing? Were you able to create a new Bitwarden account using your old Bitwarden email address (the one where previous Bitwarden emails were sent)?

1 Like

I was able to create a new account using the same email address that I used before.
But as the support agents told me, it still has a chance that they changed the email address of the account then deleted all traces.

They could also made a backup then deleted the account as well.

1 Like

Yes, the problem is that there is no confirmation about what happened. If you didn’t delete your account, then someone or something else did. You might not have a way of preventing this from happening again.

I would think about changing all the important passwords. If I were you, I would do that now, and regularly change the rest.

1 Like

If you formatted the device, then the data.json (and all other files on that device) would have been deleted.

You will need to find a device where you had previously logged in to your deleted account that has not been formatted/wiped.

1 Like

@youtube.4fun If you believe that you may have such a device, please completely disconnect the device from the internet before investigating any further.

1 Like

Thanks kpiris and grb for sharing. I still have these devices.
The MacBook that I bought: I’ve logged in there but just before that I’ve got forced logout, where can I find it on a Mac?
I also have an iPhone 15 Pro (main phone) which had Bitwarden (I even uninstalled after this happened because I was unsure if it was causing some harm).
I also had it installed in my backup phone (the phone that was used to be my last resort), an old [unrooted] Galaxy S10e.

Is it possible to fetch these files on iOS and Android as well? If yes, where should they be located?

Any advice?

Did you even bother reading the link I posted for you???

1 Like

Oh, I’m super sorry Kpiris, in my browser I didn’t noticed that was a link, it appeared like an ad in the middle of the forum. I’m reading at this moment. The one that you shared int he last comment leads to this post here, but I found it, is it this one, correct? Data Storage | Bitwarden

I’ve just read the link. I’ve still have Bitwarden installed on my MacBook which I forced logout.

It was the App Store version, tried finding it here as described in the link:

  • Mac App Store: ~/Library/Containers/com.bitwarden.desktop/Data/Library/Application Support/Bitwarden

But there’s nothing with such name or a similar one there.

Just for a double check, I also tried to find it on the standard installation method path:

  • Standard installations: ~/Library/Application Support/Bitwarden
    Also, couldn’t find it.

It was also installed as a Chrome extension on my Mac, tried finding on ~/Library/Application Support/Google/Chrome/Default/Local Extension Settings/nngceckbapebfimnlniiiahkandclblb
There’s nothing with such name.

Do you know if Bitwarden changed the coded name of these extensions since this article was created? Data Storage | Bitwarden

Tried to find on my Android even after uninstalling it to see if there was any leftovers, no success finding on * Android: /data/data/com.x8bit.bitwarden/

Tried to find on my iOS mas as well it was uninstalled.
Also, I don’t know how do I browse files in my iOS, tried going here * iOS: app group for group.com.8bit.bitwarden but no success.

If by any chance I find it under these two extension coded names that I have on my Mac, inside that folder, is the file name called: ‘.global_account_accounts | keys | .’ < data.json?

Should I run this command: jq -r ‘.global_account_accounts | keys | .’ < data.json

In that folder?

If I do this on one of the folders that I found, I would be able to recover my account?

Thanks in advance
Best
Rei

I was suggesting all this in order for you to find out what was your account internal ID so that you could ask Bitwarden support if that ID still existed on the server your account is/was.

If you were still logged in with your account on a device of yours, perhaps there would be something that could be done.

But I wouldn’t bet on it. Sorry.

1 Like

Guys, I’ve managed to repair my old MacBook Air A1466 2017 in which has the Browser Extension on Brave.

I’ve found the file under that the article is referring to: * Brave: %LocalAppData%\BraveSoftware\Brave-browser\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb

The path is slightly different (maybe it changed after the article has been wrote).

@kpiris told me to run this command “jq -r ‘.global_account_accounts | keys | .’ < data.json”

I’m completely new to Mac Terminal, how should I exactly run this command?

Is it possible to recover passwords that I had? I’m still changing passwords everyday here, one by one, it’s heavily time consuming as I don’t even remember everywhere that I’ve created an account.

Can I do something useful with this file and the command?

Thanks in advance
Best
Rei

The browser extensions generally do not have a data.json file, but in the Chromium based browsers (like Brave), I believe that the encrypted vault data are stored in a .log file (which typically has a numerical file name, such as 012345.log) in the nngceckbapebfimnlniiiahkandclblb folder. To avoid further data loss, I would suggest that you make a copy of any .log files that you see (or of the entire folder).

However, I don’t see any fields named global_account_accounts in the .log file for my own Chrome extension. A suitable alternative may be global_account_activity. Instead of using the jq tool, you can just open the copied .log file using a text editor (perhaps TextEdit or Notes on macOS), and search for the string global_account_activity. You will hoepfully find something like the following:

global_account_activity©{"__json__":true,"value":"{\"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx\"

In the above, each “xxxx” is a hexadecimal code. The string “xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx” is your User ID. There may be more than one User ID present if you have logged in using multiple Bitwarden accounts.

After doing the above, fully disconnect the Macbook from the internet (disable WiFi and disconnect any Ethernet cables), then open the Brave browser and open the Bitwarden browser extension. Can you unlock it?

1 Like

Hi @grb

Just wanted to share a quick update and say super thanks for your support! Here’s where things stand:

  1. File Recovery:
  • Successfully located the necessary files in the Brave folder
  • Used your trick to access the Bitwarden extension while logged in
  1. Data Protection:
  • Immediately cut internet access on that Mac after accessing the vault
  • Exported and backed up my entire vault securely
  1. Next Steps:
  • Currently auditing all accounts to identify which still need password changes
  • Prioritizing high-risk logins for immediate updates

Your guidance made all the difference—really appreciate you taking the time to help!

Best,
Rei

1 Like

You’re welcome. If you were able to find the hexadecimal User ID code, you may be able to follow up on your support ticket, to determine whether your original account was deleted or taken over (with a new email address and account password).

1 Like