Spam to plusnet-specific Email address.

[#1]

Sorry that we haven't provided a further update as of yet. We are continuing to investigate this internally.

[#2]

Hi Bob,
The emails were caught by gmx.com and moved into the Spam folder so I didn't even have to download them into Outlook, unfortunately I automatically clear the spam folder when logging out of GMX. I will see what I have still got - at least two were "sent" by news@liveuknews.co.uk .
I can say that the spam emails were sent to a specific address only used for my PlusNet account (not a random guess).
regards
Steve

Quote from: Bob

Can both of you advise when the first of these messages was received and would you mind PM'ing me the headers from a handful of them? I remain quietly confident that our database has not been compromised, knowing where it lives and how it's protected.

[#3]

Sorry to pour cold water on your theory - I didn't have any PlusNet accounts in 2007.
😞

Quote from: jelv

I'm seeing spam to email addresses harvested from Plusnet - in the 2007 hack. I'm also seeing spam to other emails that have over the last few years have received spam. There are a lot of other email addresses including actual mailboxes on Plusnet that have received no spam whatsoever in spite of them being used. So while I've seen a lot of these test messages, nothing I've seen points to a fresh leak on Plusnet.

[#4]

That theory has already been disproved by subsequent posts.
@avatastic
Actually I was more thinking about whether the hosting company would have that email address, but what may be on WHOIS is also a good point.

[#5]

Ah-ha - so this is where my post went - didn't spot all of this!
Having read a bit, I'm having the same issues other posters are.
It can't be the 2007 breach because I joined on PN on 5th March 2008. That's probably the only time I've used the PN-specific Clara email address in question.
I am getting lots of 'test' messages too, as well as the wowcher and other marketing spam.
Obviously something has leaked...

[#6]

Thinking it through to myself.
My email address was invented purely for logging into my PlusNet account.
PlusNet is owned by BT
BT have a long history of off shoring as much of the mundane work as they can.
It is possible one of the off-shoring companies is the source of the leak.
I am not saying it is the source of the leak, but if I was investigating I would be looking at where the user detail database is kept and who (specifically) has accessed it.
I am also hoping that my payment details have not been compromised as that will be a complete pain in the posterior.

I fully expect NOT to be told my bank details have been compromised, so I now need to decide weither to keep a very close eye on my bank account or just bite the bullet and tell the bank it has been compromised (and then have the hassle with all the direct debits that need to be changed).

Steve
adie:green removed unneeded quote.]

[#7]

I take it your don't have your own domain hosted anywhere then judging by the way you have worded that.

[#8]

You can add me to the list - as of today 21/11/14 - I've started receiving spam to a email address provided only to Plusnet, hence finding this thread.
So far had the "Wowcher" and the "Tailed offer" ones.
Something has leaked somewhere...

[#9]

Same here, in the last week I have started to receive spam to addresses ONLY used with Plusnet and Madasafish (two different addresses).
Edit: two more this afternoon, Wowcher (to Plusnet address) and Tailored Offers (to MAAF address). Are we all supposed to be PM-ing headers?
Needless to say I will be deleting both of these addresses once Plusnet has established the cause of the leak.

[#10]

That is correct.
🙂

Quote from: Anotherone

I take it your don't have your own domain hosted anywhere then judging by the way you have worded that.

[#11]

Todays new SPAM messages to my private Plusnet billing account email address are -

Quote

From: "Wowcher & E-Market Labs" <news@onepoundnews.co.uk> Subject: Wowcher gets up to 80% off your favourite products

Quote

From: "Tailored Offers" <news@onepoundnews.co.uk> Subject: Bespoke news - The right way to shop

Quote

From: "PMI Simply" <news@onepoundnews.co.uk> Subject: News - your private healthcare!

Quote

From: "Life Cover Experts" <news@onepoundnews.co.uk> Subject: News - what happens to your family if you die

[#12]

I've had this today -
From: "ProductTestingUK" <news@liveuknews.co.uk>

[#13]

I was a plusnet customer until 2009 and only started again with them this year. When I first signed up I registered with them using a plusnet specific email address on my domain. When I signed up again this year I used my general email.
I hadn't received any email on the plusnet specific address since oct 09. That is until this month when I got my first spam on 14th Nov. As far as I can see my current (non-plusnet specific) registered email is not receiving any spam.
So now I'm receiving spam on a dormant email address that was given uniquely to PlusNet and not published. Spam all seems to be coming from liveuknews.co.uk (sign up as a tester, psychic reading, laser eye surgery).
I can always set the old unique address to bounce back to sender but I would still love to know how the spammers got my pre-09 email when only plusnet has ever had it.

[#14]

Hi, welcome to the forum.
That's certainly very interesting. Quite a few posters that are getting the SPAM, joined after Oct.09. When you mention domain, do you just mean @username.plus.net as part of the email address, or do you have a website with the same domain?
Can I ask, is your current username the same as it was previously?
At present I can't see any obvious pattern connecting those getting the SPAM. Some were here during the last hack, some have only joined more recently. Not everyone has websites, people who weren't previous registered on this forum have had the SPAM.
Obviously some people aren't getting the SPAM (yet?).
It's not leaving too many possibilities and selective hacking would seem strange.

[#15]

What about the marketing preferences for the PN only email address? Are all the people getting spam somehow opted in or not? On a previous change of package I noticed that theses prefs had been reset. Maybe a long shot in terms of tracking this leak but if some email addresses had been passed on to a marketing company it kind of increases the possible avenues of the leak.
As for all our email accounts, none have received this specific spam (did get 'test' ones for a short time) and we've been with PN (free-online) well before the 2007 hack. Also to discount the £1 domain suggestion by Anotherone, we've had one for years so can't be linked to that.