Compromised Accounts/Passwords

[Danger Phoenix]

Over the years, I've been careless, complacent, foolish, overconfident, [insert other appropriate adjectives here] etc and have regularly reused passwords. I have my own domains and email is set up as catch all, so whilst each service/site has a unique email address (ie [email protected], [email protected], [email protected]), the passwords have tended to be the same.

A few months ago people started trying to access my accounts. Credentials had only ever been synced with Google, BitWarden and LastPass. Recent accounts have been accessed, so since BitWarden and LastPass haven't been used in years, and Google has 2FA set up, I can only assume that my desktop, laptop or phone have been compromised. I've scanned all three with multiple utilities and nothing significant has been identified. Whilst I have no idea how this happened, there haven't been any attempts to access accounts which have had passwords changed and/or 2FA set up, so I'm thinking that the breach isn't ongoing.

Getting banned from a few sites for posting spam and someone attempting to book a hotel this morning using my Avios points is the worst that has happened to date. Everything else has just been an inconvenience - I get an email regarding suspicious activities and then proceed to change credentials for that site.

Accounts that I believe/recall as significant have already been updated, but given that hundreds if not thousands have been compromised, it would be near impossible to update every single one and the chances of overlooking key ones is quite high (Avios account would be a prime example of this). Credit and Debit cards have also been changed. Not all services/sites alert on suspicious activity so who knows what is happening on/with some of my accounts.


What's the best way to manage the ongoing assault? Any advice/suggestions would be greatly appreciated

 

[[FnG]magnolia]

Mods, ban this fraudulent impostor.

 

[Semple]

It's definitely interesting that you'd go to lengths to mask your email, but then reuse the same password across sites.

Frankly this is where a full sanitisation is needed. Firstly you need a device you can trust - if you're not sure about PC/laptop then it's time to wipe one of them and start fresh install. From a clean environment, you can then go through each site and do a password reset, plus ensuring 2FA is setup on all necessary accounts. If you want to be extra thorough (especially if you've had accounts compromised) I would also revoke existing 2FA keys and regenerate, and also where possible change the registered email address. It's also a good idea to check any stores details - ensure a phone number (if required, is your own), for anywhere that you don't make regular purchases with, then delete any stored card details.

Also, another good step to do for full sanitisation if you want to be thorough is closing down accounts that you no longer use. Some sites don't make this easy, but there's usually an option to close account, or send an email off to customer services requesting your account be deleted.

 

[monkey_boy]

Go through your last pass and regenerate passwords for each site. Set up 2FA where you can.

 

[Oh Ed not again.]

My card was compromised on Friday, some tube tried to spend £87 online at Toolstation.

I only use contactless and GooglePay on the PC when making purchases. Very, very rarely use the actual card number itself. Which led me to the same conclusion as the OP, that one of my machines has been compromised. I have 2FA and use "set and forget" strong passwords for just about everything. Meaning that I reset the passwords often, as for a lot of things I just do a password reset with a new password for that session. Google Passwords are encrypted in Chrome too.

No unusual activity on my Google account spotted, so I'm at a loss as to how my details were compromised.

 

[Feek]

the passwords have tended to be the same.

This is why we insist on 2FA for anyone who has reached the MM access requirements.

 

[Pawnless Endgame]

@Danger Phoenix - does your workplace give you any mandatory training. My workplace (NHS) provides a Cyber Security refresher every 1-2 years, which covers strong passwords, password management, 2FA amongst other topics. Might be worth taking if it's offered, as I find it useful too.

I fell foul of bad password management (re-using same passwords) back in 2003. The internet was around for a few years by that point but 2003 was early days for broadband. I lost my Hotmail / MSN Messenger account and several forum logins as a result. I managed to get 1 forum account back by contacting the mods but lost the others and didn't bother re-signing up. For MSN, I just created a new account and repopulated my buddy list with the contacts / emails that I could remember.

So yes it's probably best to just sever anything not so important and get passwords changed for everything else, and make different passwords with a mix of different character types.