0

An important email got hacked (I got a notification from my provider that he changed the PW because my email login was used worldwide to send out emails, mostly spam I guess). I assume it was hijacked and not spoofed.

This email is usually used to register web services etc. for example it is used with AWS3, heroku etc. I have no clue how someone got access but now I am here, shit happens.

I need to figure out what happened exactly, but I dont know where to start.

I contacted my provider, so I get detailed numbers on how many emails were sent out and I will also change every password and use simple antivirus, but I am afraid that this is not enough?

I also checked every email which I received in the last weeks, there was nothing suspicious.

EDIT:

Thank you all for the answers, they still help me to be prepared in future.

According to the current situation:

My provider answered very fast and it seems that the issue was caused by me. I use this email to send out news to our users and every week we have more users and obviously more emails. The automatic notification and PW reset was triggered by me sending out those emails. I simply have to adjust security level of this email and thats it.

closed as off-topic by Anders, Steffen Ullrich, ISMSDEV, Steve, Xiong Chiamiov Nov 21 '17 at 19:34

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • You are not providing sufficient details. Is your e-mail address hosted on a local server, is it something like OWA or is it hosted by a payed/free 3rd party ? – Overmind Nov 20 '17 at 10:12
  • 4
    After the edit by the OP it was clear that this was a configuration problem and not a security problem. Thus I'm voting to close this question as off-topic. – Steffen Ullrich Nov 20 '17 at 12:16
2

You already changed your password, so the first thing to do would be to enable Two Factor Authentication if your provider has that service (and if it doesn't, I'd highly suggest changing provider).

Another thing is to make sure you use an exclusive password for that account (ideally, you would have a different password for every account and use a password manager to handle them). Many accounts get hacked because they use the same password on different sites. If one falls, all follow.

The last thing would be to thoroughly check your PC for malware (keyloggers and the like), and to make sure your provider always uses encrypted channels when authenticating you (https requests only). Again, if it doesn't, there is nothing you can do but change provider.

EDIT: Your account may also have been blocked due to an activity that appears irregular but is actually normal, like logging from another country/using an unknown device, or sending emails flagged as suspicious by spam filters. You should check with your provider if this is the case.

Side note: never connect to sensitive accounts while connected to a public hotspot. Connections can be spoofed easily if the attacker is in control of the access point.

  • Thank you very much, I have different PW everywhere and very complex ones. I save PW's in a .txt file and PW protect the folder. My PW's are never online. Check my EDIT – Roman Nov 20 '17 at 10:20
  • @Roman happy to know you solved your problem and that it was nothing serious. However, have you considered using a password manager instead of a simple txt file? Many things can go wrong with that – BgrWorker Nov 20 '17 at 10:25
  • Actually I am researching right now about this topic. Can you recommend something? But it has to be a software which is not online or cloudbased etc. – Roman Nov 20 '17 at 10:26
  • If you add my situation to your answer, I will accept it. Basically the issue can be caused by oneself. – Roman Nov 20 '17 at 10:30
  • @Roman added your specific case to the answer. As for the password manager, I'm currently using Keepass, which is completely offline. – BgrWorker Nov 20 '17 at 10:44
1

Try to check if you were not a victim of a known data breach, this might be a good point of start:

Not the answer you're looking for? Browse other questions tagged or ask your own question.