Has my globalnet address really been hacked?

[#1]

I just received a nasty email that appears to have come from my own globalnet account and which is trying to blackmail me into paying into a Bitcoin account. The blackmail threat is rubbish (porn etc.), but should I be concerned that the globalnet address it was sent from appears to be mine? Can they really hack into / take over my globalnet address? I haven't been able to forward the email to abuse@plus.net as it fails to send, being 'rejected as spam'. 

Any advice would be appreciated. Thanks.

This is how the email starts –

Hi, dear user of globalnet.co.uk

We have installed one RAT software into you device.

For this moment your email account is hacked (see on "from address", I messaged you from your account).

Your password for [*my correct globalnet address*] : [* not my correct password*]

I have downloaded all confidential information from your system and I got some more evidence.

[#2 · Accepted solution]

@lr - Pretending an email has come from your address or indeed any ones is very easy to do so don't worry about it. As they don't appear to have you password, just change it for peace of mind. It's simply a ploy to set fear and panic and extract money from you. Put it in the bin where it belongs.

Edit:- Corrected typo.

[#3]

Ah, thanks very much for explaining that so clearly and so swiftly, Mook. I will do as you suggest and can now enjoy a more peaceful Sunday. Thank you.

[#4]

My wife received the same email on her plusnet account, it was actually sent from her account (check your sent email). The password in the message was correct unlike the sample illustrated (well correct letters, incorrect case), but the fact that emails were in sent box suggested they have the correct credentials. We have changed and strengthened all plusnet passwords.

The email did originate from the web mail, not our local machine. Suggests to me that plus has been hacked.

[#5]

I've had a couple of these - I think, my Mailwasher program correctly identified them as spam and refused to allow me to download them (or even view the headers), so I've no idea where they have come from.

As they 'originate' from a sub-account, not my main one, I doubt it is Plusnet who have been hacked, rather one of the organisations where I use that a/c and password.

I shall be amending those accounts fairly quickly.

[#6]

Both my wife and I are getting these nasties regularly. My wife finds them very upsetting. The body of the email contains the correct passwords.

I have phoned Plusnet to get these passwords changed but they didn't seem to know what I was talking about (globalnet and its password) and merely changed my main Plusnet password, which just created confusion.

We would both like reassurance from Plusnet that our globalnet account is secure and that these emails have no basis in fact. It's worrying to us that the passwords mentioned are correct. How could anyone get these other than by hacking into globalnet?

Chris

[#7]

Sorry to hear this.

I've checked your account and can't see any cause for concern but if you want to change your password you can do this on the Madasafish website by going here

[#8]

Matthew

Thanks for verifying the account is ok but I would still like to know how a third party can show both of us that he/she knows our passwords.

And what I said before still applies, you suggest changing the password to enter Madasafish but it is not the same thing as the globalnet passwords, of which we have one each but the Madasafish website only requires one. As far as I remember we needed the globalnet passwords only when we set up our respective email programs on our respective laptops. We have never had to use them again....whereas to use the Madasafish website we would need that single password each time.

So I say again, they are not the same thing.

Chris

[#9]

---

@cbar wrote:

Matthew

Thanks for verifying the account is ok but I would still like to know how a third party can show both of us that he/she knows our passwords.

---

Do you use the same password on multiple websites? There have been a number of high profile hacks on well known websites over the years, when usernames and passwords were compromised. (Adobe and Trillian spring to mind).

I have been getting these emails regularly over the past few months. They show my email address,  and a password that I used quite regularly in the dim and distant past (probably filched from one of the websites I mentioned above).  It is not a password I use now, and on all sites where it was used, including the email account referred to in the scam,  I have long since changed the passwords using the Lastpass manager. Passwords are now site specific and (at minimum) 12 character random strings.

So if the spam email you have is showing a genuine password that is still in use you should change it immediately on all sites, starting with banking/finance sites and any shopping sites where you might have credit card details stored

[#10]

@cbar,

When you login to the MAAF portal you login with your main MAAF details. Within the portal (not the webmail system) you can change your individual mailbox password by going to 'internet', 'extras' and then 'mailboxes'. You have to change your mailbox password via there.

After you change the password via there make sure you update it in any the applications you use (Outlook, Thunderbird, Mac Mail etc,). 

As @beeceegee has said there are a multitude of ways your password information could have been compromised, changing it is the first thing you should do. I would then virus scan any machines, and then as advised immediately stop using that password for any site, and change any that currently use it. 

[#11]

Thanks for help. I am doing as you both suggest.

cheers, Chris

[#12]

Anytime @cbar. Let us know how you get on.

[#13]

I had a similar email, but it included my actusl password!

[#14]

Sorry to hear that @cbar.

We would suggest changing your password to be on the safe side.

[#15]

Goes without saying, password changed. But how was it discovered?