URGENT! Account hacked

[#1]

Hi Mardler,

Yes the email I received had my full Plusnet email address listed and the password. They were the only parts of the email I could read, the remaining was written in Chinese.

Interesting I upgraded my virus and malware protection on my Macs today. It found 8 malware problems installed on the same day I received the email. It’s removed them now. Google translate reads the email as a demand for money, sent and received from my Plusnet email.

My concern is with Plusnet and the passwords not updating, in my first online chat they reset the password for me. I logged in using it, changed it and then logged out. Tried to log in again I was stopped using my new password, used the CS chat one and I was in. Also at that time I didn’t update my router, yet the internet service continued. I changed it a few times yesterday and wasn’t rejected at all for service.

I’ll forward the Chinese email to Plusnet. I am changing supplier when my contract it up in 10’months I want a company that protects my personal details and with polite staff.

[#2]

Hi OP,

Weirdly, I think it has gone.

I also tried sending it to another email account on Monday but it never arrived so I found that in my Sent folder and forwarded it to phishing with a reference to this topic. Fingers crossed. 

if you can contact whoever handles such emails and direct them to this topic that would be great.

[#3]

I have mine if it’s needed

[#4]

Hi dazzy,,

That is almost exactly the same as me right down to three changes of main account password. However my last password change stuck and after a while the router couldn’t login though oddly it had worked OK for 24 hours beforehand.

However the password in my email was identical to one I use elsewhere (it’s strong) but for one character in lower case instead of upper. The password used was the one for this forum...

Glad you’ve sent your email to the phishing people. Hopefully they’ll come here with more information.

[#5]

Just checked the Outbox (iPad, IMAP) and the email is now showing there.

OP: please check with your phishing people to see if they have had my email.

dazzy: it might be worth you trying to send yours if you haven’t to see if you can get PN’s servers to accept it.

[#6]

Hi @Mardler, thanks for your response.

In my haste to respond it looks like I missed the pnet from the beginning of the email. (Hooray for copy/paste).

To clarify, you need to send it to abuse@plus.net.

Apologies for sending the incomplete address over.

Moderators Note: Corrected email address. 

[#7]

No probs.

I tried that. The one sitting in the Outbox that failed still failed but another copy seems to have worked as did a test: both are sitting in the Sent folder.

I have also emailed the same address for confirmation of receipt.

Oh and that prefix was not given to me on the phone.

[#8]

Hi @Mardler, thanks for your response.

I'll make sure that's fed on too.

Have you received any more bounce backs?

[#9]

If you mean to other addresses, no.

[#10]

@Mardler

Hi dazzy,,

That is almost exactly the same as me right down to three changes of main account password. However my last password change stuck and after a while the router couldn’t login though oddly it had worked OK for 24 hours beforehand.

Interesting read. I got an email (not to my plusnet email) from whoever the other day. They had made the sent by and to address the same. Turns out that it's very easy to do. I'm amazed really that the internet isn't secure in that it allows people to put fictitious email address as a sender of it. Seems your email address and its associated account aren't treated as one. I've just put a total block on any emails that have my email address as both the sender and the recipient. i.e. they get deleted without any input from me.

However, as the password supplied was very near to what I had used on Plusnet - I'd never ever used the exact password but it was one character out, I decided to change ALL my passwords that were anywhere near it - most are 2 step enabled already. Seems that makes life very difficult for hackers and the like anyway. 

I changed my password(s) on Plusnet and even got a confirmation via email -

Your Plusnet password has been changed.
You might need to update your router and email applications to use the new password

A few days later I had to disconnect the router - my own. I reconnected it and what the hell. Would it connect? No, it would not. I kept getting an IP address that wasn't mine and a BT page saying I wasn't connected correctly. Anyway to cut a very long story short, I realised (eventually) that maybe the router password needed to be updated - forgot all about it. That I did. Everything was working again, I even got a speed increase. Yippee.

But what was surprising, in the middle of trying to work out what was wrong I used my mobile to connect to Plusnet, using my original password. And that was 3 days after I thought I'd changed it. I've just tried again and both methods (mobile and PC) still log in on the old password. Quite obviously, I'm no longer sure what 2 passwords I updated but it certainly doesn't appear to be the one that does my account. 

Any pointers?

And why doesn't Plusnet use 2 part authentication as seems to becoming the minimum standard now?

[#11]

Not sure I can help on accessing the main server. My router logged in perfectly for a day and a half with an old router then suddenly dropped the connection during a session. Weird.

Accessing my main account was weird as I said above: the iPad refused to access the account after a password change (mine, the first was done by ano yet to be determined) but another device did. Turns out that a saved password in Chrome overrode the new one as input!

[#12]

I tried logging in my account using the new password and it's a fail every time. And yet the router is now using it.

Totally blown!

It seems there are a lot of those emails, demanding payment etc floating around. Mine was in English. All it got from me was a hit the delete button. Gone.

[#13]

Exactly what mine done yesterday, router used a password that was rejected elsewhere on Plusnet. Odd, at one stage I had three passwords working. One on the router, one on the website log in and one set via the keys. I finally used the reset password email link which seemed to align the passwords on Plusnet. But there is a problem they need to look at.

[#14]

Hi @Mardler, @idonno and @dazzy747,

I'm sorry to hear that you're all experiencing password problems - thank you for bringing this to our attention. I'll pass this on so that this can be looked into further internally.

[#15]

See above, it’s already being dealt with.

The problem isn’t simply “password problems”, it’s caused by hackers changing passwords and then sending ransom emails to PN members.

It looks like an extremely serious security breach and should be escalated to the very highest level. Yes, that means CEO.