In the midst of using a popular online service the other day, I noticed some curious activity. My usage was diverted - while I was interacting with the service - into activities that were not (and would not have been) of my choosing. This access was registered as coming from an iPhone, and I don't own such a device. The activity made some (free) additions to my account.
At first I had no idea what was going on - I thought it might be a family member using an iPhone and "borrowing" my credentials. It took some hours to establish that it was not, by which time the suspicious activity had ceased, although the changes made remained. I accessed this service using my Facebook credentials. To be sure, I then logged out of both the service in question and Facebook and changed both passwords to strong, unique ones.
I have contacted the service provider, who has told me that "another user" gained access to my account and that I did the right thing to change my password. They refused to divulge any further details.
However, this breach seems unlikely to have been malicious due to the pattern of behaviour. Specifically:
- There was no attempt to change the password or email associated with the account.
- There was no attempt to use the payment access on the account to purchase anything.
- Access to the account was via Facebook, and there was no attempt to change my email or password there either, nor was there any suspicious activity there at all.
- A third service was linked to the suspicious one, which records my activity there. None of the suspicious activity was recorded, which is most peculiar.
- The suspicious activity ceased of its own accord some hours before I changed the passwords.
So there are two possible options here. Either someone got my password for this account or this service has a security flaw that can lead to shared data and activity between accounts. Obviously, either is alarming and I'd like to know which one it is.
Can the lack of malicious actions taken during the breach be taken as any indication that it was not a deliberate hacking attempt? What other possible reason would there be to make non-malicious use of someone else's account in a non-social/public service?