Email and password on sale on darkweb

[#1]

Experian have informed me that my email and password for plusnet is now freely available for people to buy on the darkweb.

i was wondering if someone could advise me how this could happen, I imagine there is some record of the login attempts made.

Being that my stuff is all up to date in regards to security, perhaps you've had someone gather this info from yourselves or is it an inside job ?

many thanks.

ps after the worse home move experience I had recently ,this just about kisses our business together good bye.

[#2]

First thing I would do, assuming this is genuine, is change your password and make it as strong as you can.

[#3]

If I remember correctly, Experian where hacked a little while ago. At a total guess I suspect they are saying that your experian username (email address) and password where taken and are available, rather that your Plusnet details, though if that is a Plusnet email address and you use the same password for both then it would amount to the same thing.

It would definitely be safest and certainly wouldn't do any harm (other than take a bit of your time), to go through and change the passwords anywhere that you've used that same password.

[#4]

Done straight away, but there seems to be some serious security issues with plusnet

some digging has revealed this article where someone has had full passwords relayed back to them, something which is very, very wrong.

https://www.grahamcluley.com/plusnet-isnt-acting-safely-password/

If true this is a huge flaw in the way plusnet store passwords, and has been since before 2015

to note today my plusnet router is now unconnected from broadband over night, yet we have no outages in the area.

Im now deeply concerned by plusnets activity, and will be taking this further.

[#5]

@pjmarsh

All changed, it's definitely plusnet webmail, I have three separate flags come up.

[#6]

https://community.plus.net/t5/Plusnet-Blogs/Webmail-Incident-Report/ba-p/1313738

[#7]

@pjmarsh, wasn't that Equifax and not Experian?

http://www.bbc.co.uk/news/business-41575188

[#8]

@Anonymous, ah yes you're right.  The Experian hack was a couple of years ago: https://www.theguardian.com/business/2015/oct/01/experian-hack-t-mobile-credit-checks-personal-information

[#9]

Even then that hack was only in the USA and limited to T-Mobile Credit Checks, so I don't think this will be related to the OPs issue.

[#10]

this is a quick check - just put in your username https://haveibeenpwned.com/

[#11]

Yes @Anonymous.  As I said earlier I was just working from memory, so obviously mis-remembered the details

[#12 · Accepted solution]

We take the responsibility of protecting our customers’ data extremely seriously and as a result have thoroughly investigated these claims. We can guarantee that the compromise of your email address was absolutely not from Plusnet. With regards to the password, Experian shouldn’t be able to tell if it is compromised as this would mean they know it. Our security team would be happy to chat to you about online safety and we have messaged you separately to discuss how we can help you.

[#13]

Hi Matthew 

Experian don't have knowledge of the password, judging from the report sent to me by them, neither does the person selling the information.

Yes, basic online security was observed, no reusing passwords, or storing on devices.

I would like to say a big huge thanks to those who spent time investigating this issue, along with the very knowledgeable gentleman who phoned me to clarify the issue, with the findings of the investigation.

Very hugely appreciated