Massive usage increase - Support no help

[#1]

I have just received a warning that I'm approaching my limit this month, which is odd because I usually use less than a quarter, so I checked my usage breakdown and see that it's an increase in web traffic starting on 26th April in the daytime and 2nd May overnight. As I have no idea what this huge increase could be and I haven't changed my online habits I decided to contact support for assistance with tracing the problem. Here is the chat session:

Thank you for choosing to chat with us.

Please do not navigate away from this page or connection may be lost.

Chat sessions may be recorded for training and business improvement purposes. For full details on how we use your personal information see our Privacy Policy
Info
 at 16:13, May 10:
All agents are currently assisting others. Your place in the queue is 1. Thank you for your patience.
Info
 at 16:13, May 10:
You are now chatting with [CSA Removed].
[CSA Removed]
 at 16:14, May 10:
Hello, I'm [CSA Removed]. How can I help?
Kenneth John Petrie
 at 16:14, May 10:
From 26th April there has been a huge leap in my daytime http usage for which I cannot account. Overnight usage has also increased from 2nd May, again massively. As I have not changed my usage habits, can you give me any guidance as to where this usage has gone so I know what to look for on my machine?
[CSA Removed]
 at 16:16, May 10:
hey there, automatic updates in the background use a lot of data, also automatic virus searches, any news/weather applications also continue to use data a lto
[CSA Removed]
 at 16:16, May 10:
lot*
Kenneth John Petrie
 at 16:17, May 10:
I only do automatic updates overnight. What I need are log details so I can see what has happened in order to stop it.
[CSA Removed]
 at 16:18, May 10:
we can not see what applications are using what data, that information would be stored on your pc and not our server
[CSA Removed]
 at 16:18, May 10:
I'm really sorry about that
Kenneth John Petrie
 at 16:19, May 10:
But you would have logs of the destination addresses of packets. You are required to keep that by law to trace subversive activity, so you must be able to tell me the destination addresses to which these extra packets have gone.
[CSA Removed]
 at 16:20, May 10:
im afraid we do not hold intrusive information in the tech support department, information like that is only to be found in severe cases where needed and not for general questions such as usage used.
Kenneth John Petrie
 at 16:22, May 10:
But you must be able to arrange for it to be available for me. I'm asking for information on my own usage which I need in order to troubleshoot what is clearly a problem.
[CSA Removed]
 at 16:22, May 10:
im afraid this information is not available as explained, you have the categories of where your usage is used and its the customers responsibility to keep track of this
[CSA Removed]
 at 16:22, May 10:
I'm really sorry about that
[CSA Removed]
 at 16:23, May 10:
Have I answered all of your questions today?
Kenneth John Petrie
 at 16:24, May 10:
You have not answered my question at all. This is useless. It's clear to me some unauthorised activity is taking place on my account and you are refusing to help me find out how to track it down.
[CSA Removed]
 at 16:25, May 10:
Im sorry you feel that way, however as explained the reasons why data fluctuates
[CSA Removed]
 at 16:25, May 10:
sorry once agai
[CSA Removed]
 at 16:25, May 10:
again
Kenneth John Petrie
 at 16:26, May 10:
I shall post this exchange on the Forum. I don't expect this level of non-co-operation.
Kenneth John Petrie
 at 16:27, May 10:
I shall be raising an official complaint if I don't get a satisfactory answer.
[CSA Removed]
 at 16:28, May 10:
im afraid we dont hold any information on our systems except the categories that the broadband was used on
[CSA Removed]
 at 16:28, May 10:
i am sorry
Kenneth John Petrie
 at 16:30, May 10:
So am I. You might not have the data, but you should know how to help me get it. Maybe the people on the Forum will be better at this.
[CSA Removed]
 at 16:30, May 10:
im sorry you feel that way, but we do not hold specific information that you require/an someone here tell me how I can find out where all this extra traffic has been going?

Can anyone here help me find out where this extra traffic has gone?

Moderator's note by Adie (Dvorak) CSA name removed as per Forum rules

[#2]

I think you are wildly overestimating the amount of data plusnet are keeping about your individual internet usage.

If they kept the level of detail you think they keep for every customer the prices would be vastly more expensive.

They also aren't required to keep all that information by law.

[#3]

Is the increase continuing? The Windows update that was presented to me this morning was 825mb big (I don't do auto updates for anyone). The mobile also seems to be always updating of late. You need to look closer to home. Has your router been compromised etc? Could be anything really.

And yes, going over the limit is tough. Been there, done that. One reason I decided to go unlimited. No hassle with caps.  

[#4]

Every connection on the Internet is logged. Every DNS enquiry is logged. Every web or mail server logs every request. Every IP address allocation is logged. It's not expensive; it's automatic and standard practice. Content isn't logged, just the metadata. The data has to be kept for a period for crime-detection purposes. I think it's 18 months but I'm not sure about the precise period. The increase in usage is staggering - from 14th-25th Apr daily web usage was around 20MB. From 26th Apr-present it has been around 500MB. All downloads of upgrades are scheduled to happen at around 6am, well before the metering starts at 8 am. However, they could never be that big every day. I use PCLinuxOS and FreeBSD.

I am worried precisely because I think my router or PC might have been compromised. Clearly this massive change in usage must have an explanation, but I can't find anything on my machine so far, and it would be good to have access to more info about the traffic to narrow it down. If I knew where it was going I might know what to look for. I wouldn't expect a chat operator in Customer Service to have that info, but I would expect them to be able to facilitate obtaining it for the customer after appropriate identity checks. After all, it's in everybody's interest to prevent network abuse.

[#5]

Have a look at this thread which shows there is a known problem with usage recording..

[#6]

Thanks, but I contributed to that thread and was reassured there wouldn't be a problem, but since I've received an e-mail warning, which we're assured are accurate, that's no comfort.

[#7]

Apologies, I missed your post in that thread