Hacked lineone email

[paultrench]

Can Ady please send me a personal email in order that i can recover my hacked lineone email. unfortunately i cannot do a password reset as the hackers have changed my recovery number and email.

I am the originator of this email address and can provide you with id info etc to verify for data protection

[Ady-TalkTalk]

Hi paultrench, what matters to you, matters to us. That's why we're listening to more of our customers than ever before. Thinking about the interaction you've just had with us on community today. 

We'd like you to answer a few questions, but we promise it won't take any longer than five minutes. 

https://survey2.medallia.eu/?tt-digital-service&convid=30873855&source=lithium&agent=Adrian+Wood&cam...

Thanks for your time & don't forget we'd like you to answer the questions based on your experience with us today. 

Take care

[Ady-TalkTalk]

Let's hope that's the end of that.

Ady

[paultrench]

Thanks Ady, just got back in and signed out the hackers device and deleted his rules so hopefully finally resolved

[Ady-TalkTalk]

Hi Paul, thanks for the additional information. I've requested the Reset Tool be updated again for you. 

Ady

[paultrench]

Hi Ady 

I have now provided you with all the info in the 2 personal messages i sent earlier today so would be grateful if you would arrange the further reset tomorrow.

Regards

Paul 

[paultrench]

Ok Ady will inform you of further alternative email and mobile as a personal message but the hacker has reset my first alternatives to his own again so don't think he will be able to get access that way.  I will be signing out his device when i get access again as that is the only way i can see that he was able to change the reset last Friday

[Ady-TalkTalk]

If you use the same mobile and email the hacker still has access to reset it. You need to use something different

Ady

[paultrench]

Hi Ady

The answers are the same as the first reset and I've just resent them to you again by replying to your message

[Ady-TalkTalk]

I've got no details from your answers showing on system. I've sent it again. 

Ady

[paultrench]

Hi Ady

I replied to your private message yesterday and would be grateful if you would arrange another password reset

Regards

Paul 

[Ady-TalkTalk]

Hi paultrench, I've sent another private message. 

Ady

[Gondola]

It is important to carry out all the security related actions I've mentioned.

[paultrench]

Hi Gondola

After giving this some further thought if the hacker was still logged in he would have seen the email notification from TalkTalk that my password had been changed which would have alerted him to check the reset which he could then change and do his own password reset. It is therefore very important to sign out all unrecognised devices after someone recovers their email after it has been hacked

[paultrench]

Thanks Gondola, hopefully Ady can help me out again on Monday or Tuesday

[Gondola]

Hi Paul

If you successfully proved there was no virus or other malware capturing your password and the new password met security requirements and wasn't readily guessable then we have to assume that the hacker was actively signed in to the mailbox and happened to notice you had new password recovery Reset details. Unusual but not impossible.

But make sure there are no Rules defined at all as it's not just the standard Auto forward rule that can spy on your mail messages. Hackers set and change other filter rules to see what's happening. 

The new security feature that allows users to see which devices are signed in to the mailbox is there to help you control access.  In the case of unauthorised access to forcibly sign out that device so you can change the password to lock out that device permanently. It's also useful in troubleshooting when the system detects multiple sign ins from geographically distanced locations and therefore limits the sending of mail to guard against spam sending but does not at that point lock out the user(s).

Remember that the hacker knows your email address so the only thing protecting your mailbox is the uniqueness of the password and its strength.

Are you positive your password recovery email address isn't compromised? It might be worth setting up a new Gmail / Yahoo Mail / Outlook.com address for password recovery if you're at all unsure.

[paultrench]

Hi Gondola

I did the scan and there were no rules for email forwarding but did not know about the security option to sign out unrecognised devices.

If Ady could issue the password reset again i will sign out the hackers device if it is visible but do not understand how it was possible for him to gain access. Is there nothing TalkTalk can do at their end security wise to prevent it happening as he couldn't get access with my reset email and mobile number 

[Gondola]

Hi Paul

Ady will return next week. I gave you the advice to scan all your email devices to remove password capturing viruses, trojans and other malware before changing any password. Also to delete any Rules (Filter rules) spying on your mail messages by copying or diverting mail from your Inbox.

In addition, as soon as you get access to a newly migrated mailbox there is an additional Security option to forcibly sign out any unrecognised devices.

Via the main settings cog icon top right, select the All settings menu item, select Security and Sign out any unrecognised device or select Sign out all devices and confirm the sign out of all except the one you're currently using.

[paultrench]

Hi Ady 

Thanks for the reset which i did this afternoon and followed the instructions to the letter but when i just tried logging in this evening to check all was ok the hacker had gained access again, changed the password and changed the reset details to what they had before. I have no idea how this was possible as i am using a different laptop to log in so completely bemused. Can you therefore please help me again and what can be done to stop the hacker Regards Paul

[Ady-TalkTalk]

Thanks for providing the information. I've sent the request for the Password Reset Tool to be updated for you. It will complete within the next 24 hours. To check when its completed simply go to the Password Reset Tool intermittently until you see your correct information in there. 

Ady

[paultrench]

Thanks Ady and have now responded to your message