URGENT! Account hacked

[#1]

I just posted under email that I had a strange Chinese email sent from my PN address to a recipient that looked like my password which was identical bar one letter being lower case instead of upper case.

I was unable to access my broadband main account until I changed my password therefore my account has been hacked and no doubt personal data including banking details stolen in which case I hold PN responsible for any ensuing loss and/or damage.

Please RESPOND URGENTLY.

[#2]

Use CHAT to contact PN.

[#3]

My account has been hacked again!

Am unable to get in using the password I changed a few minutes ago.

[#4]

@Mardler The first thing you need to do is to check the Sent folder of your email, to see if the email you got was actually sent from your account, if it was then it will be there. If after changing the account password you still can't get in then it would appear that you may well have a keylogger installed on your system, otherwise how would the 'hacker' know you changed your password!

As for holding Plusnet responsible this can only be the case if their system has been compromised, as it is your responsibility to ensure the integrity of your password(s) wherever they are used.

[#5]

There is no sent item on this iPad (I haven’t used the PC since yesterday afternoon).

I called PN support who were totally unhelpful.

Would a keylogger reside on an iPad?

[#6]

I have just tried to access my account again after being logged out: the password has been changed again!!!

[#7]

Does the iPad Client use IMAP for the mail or is it POP? If it's IMAP then you should see an email in the Sent folder regardless of where is was sent from. Login to your email using the Plusnet web mail and check there, if your account has been compromised then this would be the place I'd look.

Just because its an iPad doesn't preclude it from being compromised. Also ask yourself who has access to your network and your devices?

https://webmail.plus.net/

[#8]

IMAP

No-one apart from my wife and myself have access to the network and our devices.

I will look at the webmail.

I have copied most of the offending email to Notes and will delete it.

No-one has come up with a reason why my PN account password is being changed as soon as I manage to log in.

[#9]

Hi @Mardler, we take matters like this very seriously and would like to look in to this further. Could you respond to the PM I've sent over.

Thanks.

[#10]

Well that tells me that the email wasn't sent from your account if it were it should be in your Sent folder, and if the 'hacker' deleted it they're not very good considering leaving it is concrete proof that your account is compromised.

[#11]

Interesting.

I have accessed my account using a different device and got in straightaway. I have cleared browsing data on the iPad but no difference.

[#12]

Mook: then how did the email have my PN account password?

HarryB: where is the PM?

[#13]

If you click on your forum name/avatar in the top right hand corner of the page, you should be able to access your PM's by clicking the notification next to the envelope or select Private Messages from the list below this.

[#14]

By your own admission @Mardler they didn't have the exact password it was no doubt harvested from the leaks cited elsewhere. It is beyond trivial to make an email look like it has came from your own account. I don't have an answer as to why your password is changing but I'm sure Plusnet and @HarryB will be able to tell where the changes originated from, if I recall correctly the system sends you an email when this happens.

[#15]

HarryB: I have replied.
Mook: the password is the same as the one I use here. Anyway, the fact that I can access my account on a different device using the last password I updated tells me that the iPad is comprised despite running Sophos security. You may well be right about the keylogger.