1

I'm a software developer so aware of basic security issues. I use a popular music streaming service and a few months back signed up for their paid plan as I was enjoying the experience. I use the service as an app on my android mobile.

After several months of good service I started having network issues which made the app unusable, it would stop after every song. I contacted the support team and they weren't very helpful but did suggest clearing the cache, reinstalling etc. A day later I noticed that I couldn't log into the app and that I couldn't reset my password so the next day I contacted their support team. They told me that the account was now registered with a different email address and name but was still connected to my credit card. User was in a different country and I had received no notification of any account changes. They didn't seem surprised by this and didn't offer much advice other than reassuring me that my information was safe, which wasn't very convincing.

I've cancelled my credit card and dropped my subscription and changed my password to something stronger. I still have access to the app and I noticed there was a connected device which wasn't mine so have deleted it. A few hours later though this device reappeared. This was unexpected although it's possible that there were some cached credentials on that device I'd have expected them to be invalidated following the password change. After deleting the device again it did appear once more but hasn't subsequently.

Reason for posting is I'm not sure if I should be concerned for other services. I've changed my password for other sites I use commonly and enabled 2fa on my email. I've registered for so much stuff it's hard to ensure it's all covered. This kind of thing is so common it would be good to have a list of advice links of common stuff to check. I'm still not sure how my account was compromised but I'm thinking it may be due to using over unsecured wifi while abroad on business.

Improve this question

1 Answer 1

Reset to default
3

I'd say you've done the right thing, adding 2fa and changing your passwords, cancelling credit cards, ect.

I'd recommend enabling 2fa everywhere you can, including the music app if you can, and change that password again- unless you've already done so since the last time you deleted the unknown device.

When you mentioned changing your password on a few other sites you frequent, that suggests that perhaps you've been reusing passwords? In any case, I highly recommend a password manager, such as LastPass, to enable you to have strong, unique passwords over all of your accounts.

To further prevent something like this happening, you could get a VPN to use on unsecure WiFi networks (or all the time) I use F-Secure's Freedome vpn all the time on my mobile devices.

Links:

List of Password Mangers - https://en.wikipedia.org/wiki/List_of_password_managers

Freedome - https://www.f-secure.com/en_GB/web/home_gb/freedome

Improve this answer
1
  • 1
    Thanks, I don't tend to reuse passwords but the idea of a password manager is a good one. I always assumed they were a bit of a hassle but I might give it a try now. I've not used a vpn for personal use but would definitely consider it in the future for unsecured wifi
    – kayakpim
    Commented Jul 11, 2017 at 12:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .