You may have heard that a widespread security problem – ‘Heartbleed’ – has been found that affects a large proportion of all websites on the Internet.

Here is one of the many explanations about the nature of the problem.

Members of the mySociety team have reviewed our potential exposure to the vulnerability.

We have no indication that our sites have been attacked, or that any information has been stolen, but the nature of the vulnerability would make an attack difficult to detect, and we prefer to be reasonably cautious.

What does this mean for you? The advice from around the web has been for people to change passwords, especially on sites they use that contain a lot of very important information (e.g. your email account).

We think the risk that passwords have been compromised is low, but as changing passwords occasionally is always a good idea anyway, now might be a good time.

For those of you interested in the technical detail of our response, we have:

• Upgraded the SSL software
• Installed new SSL certificates based on a new private key
• Revoked the old SSL certificates
• Replaced the secrets used for security purposes in the affected sites
• Removed active sessions on affected sites, so that users will need to log in again
• Required that users with administrative access to affected sites reset their passwords
• Required that staff users reset their passwords
• Notified affected commercial clients so that they can take appropriate action