Heartbleed Website Security Issue

April 10, 2014

If you've been watching the news, you’ve likely heard about a recent internet security vulnerability that was discovered called "Heartbleed." It's a serious vulnerability that could have been used to access personal, secure information such as website passwords and other account information. It's reported that as much as 66% of all websites are affected by Heartbleed. 

NWA takes security seriously and you can feel reassured about using our website. NWA applied the necessary security patches and updates to nwica.org within hours of their release and less than a day after the vulnerability was publicized.

There is no evidence that anyone has used the Heartbleed vulnerability to access sensitive information on nwica.org.

All of the measures described in this email are precautionary.

If you have made a purchase with a credit card on nwica.org, note that your credit card information is not stored on our servers and therefore cannot be retrieved from our site. In addition, our payment processor, Stripe, is an established and secure payment processor that took immediate actions to protect its own servers.

As an additional precaution, it is recommended that you change your nwica.org password. This will help ensure that anyone that exploited the vulnerability before it was publicized will not be able to access your account.  To change your password, follow these steps:

1. If you have a profile on nwica.org, visit our "Forgot Password" page to easily change your password: https://www.nwica.org/auth/forgot  
2. Enter your email in the box and click “RESET PASSWORD”
3. Check your email inbox, and you should receive an email from National WIC Association with a link to reset your password

Please call us with questions: 202-232-5492.

Additional general password tips:

• Make your passwords stronger by avoiding common password mistakes like using defaults (password1234) or things that are easy to obtain (e.g., a pet's name). Instead, use a variety of characters including letters (capital and lowercase), numbers, and special characters.
• Never use the same password on more than one website.
• Use a password manager such as 1Password, LastPass, or Dashlane to keep all those passwords straight and secure.

You can reference this NY Times article for some Q&A.