diff --git a/includes/auth/LocalPasswordPrimaryAuthenticationProvider.php b/includes/auth/LocalPasswordPrimaryAuthenticationProvider.php
index 7f93c12d4c3..86a6aae0aba 100644
--- a/includes/auth/LocalPasswordPrimaryAuthenticationProvider.php
+++ b/includes/auth/LocalPasswordPrimaryAuthenticationProvider.php
@@ -96,7 +96,10 @@ class LocalPasswordPrimaryAuthenticationProvider
 			__METHOD__
 		);
 		if ( !$row ) {
-			return AuthenticationResponse::newAbstain();
+			// Do not reveal whether its bad username or
+			// bad password to prevent username enumeration
+			// on private wikis. (T134100)
+			return $this->failResponse( $req );
 		}
 
 		$oldRow = clone $row;
diff --git a/languages/i18n/en.json b/languages/i18n/en.json
index dc5d97d41e3..5083bedae83 100644
--- a/languages/i18n/en.json
+++ b/languages/i18n/en.json
@@ -467,7 +467,7 @@
 	"nosuchusershort": "There is no user by the name \"$1\".\nCheck your spelling.",
 	"nouserspecified": "You have to specify a username.",
 	"login-userblocked": "This user is blocked. Login not allowed.",
-	"wrongpassword": "Incorrect password entered.\nPlease try again.",
+	"wrongpassword": "Incorrect username or password entered.\nPlease try again.",
 	"wrongpasswordempty": "Password entered was blank.\nPlease try again.",
 	"passwordtooshort": "Passwords must be at least {{PLURAL:$1|1 character|$1 characters}}.",
 	"passwordtoolong": "Passwords cannot be longer than {{PLURAL:$1|1 character|$1 characters}}.",