Email addresses and password sets

The Raptor

I received an email from Amazon today which seems genuine. The reason why i say it seems genuine is because they told me the problem and resetted my password. They didn't provide a link in which you normally find in scams and to try to get your details. Said that I should visit Amazon and click forgot password and to change it from there. Thats the way how I like it, I like to visit the official website and check myself rather than following links.

Now the problem. During their routine monitoring, they discovered email addresses and password sets online. The list wasn't amazon related and went on to say that many people use the same passwords for different websites. They had a reason to believe my email address and passwords was on that list.

So they resetted my password.

Does anyone know about these lists? And does it mean my details has been posted including my passwords?

nava

The Raptor wrote: »

I received an email from Amazon today which seems genuine. The reason why i say it seems genuine is because they told me the problem and resetted my password. They didn't provide a link in which you normally find in scams and to try to get your details. Said that I should visit Amazon and click forgot password and to change it from there. Thats the way how I like it, I like to visit the official website and check myself rather than following links.

Now the problem. During their routine monitoring, they discovered email addresses and password sets online. The list wasn't amazon related and went on to say that many people use the same passwords for different websites. They had a reason to believe my email address and passwords was on that list.

So they resetted my password.

Does anyone know about these lists? And does it mean my details has been posted including my passwords?

In the email you received did you check the from address was @amazon.co.uk or @amazon.com to very it came from them, but if there was no link I assume probably was unless your email provider detected it as scam and deleted it?

I never heard of websites like amazon checking any list like that, but might happen.

If you search for your email address on Google you might find it in some forum or file hosting service, it probably also contains your password but assume those forum might be underground so you won't find them in Google.

It happened to me about 10 years ago, an Irish website that sold computer parts (I don't think they still around) was hacked, all the email addresses and passwords posted on the internet.

The Raptor

My email didn't show up when I searched for it. But my password did along with my email.

It was quite scary, a whole list of emails with Irish names so it looks as if an Irish site was hacked.

nava

The Raptor wrote: »

My email didn't show up when I searched for it. But my password did along with my email.

It was quite scary, a whole list of emails with Irish names so it looks as if an Irish site was hacked.

Yes same as my case, 100's of email addresses and passwords listed, maybe what happened with Amazon is that someone tried to logon from another country so they flagged as suspicious.

Now to change all the passwords in all the websites.

L1011

The Raptor wrote: »

It was quite scary, a whole list of emails with Irish names so it looks as if an Irish site was hacked.

Here, probably - there was a total breach a few years ago.

There are sites that will show you a partial password for an email you enter if its in one of these databases and others that'll show where leaks happened

https://haveibeenpwned.com/ is one, others are findable

JackHeuston

It happened the same exact thing to me. I changed my Amazon's password but a few days later I started receiving emails from eBay and Paypal. Basically someone put up some auctions with my eBay account and I read in my sent messages that whoever did this were asking bidders to send money by those sketchy payment methods... I had my email open when that was happening so I blocked everything in time and was able to lock this person out of my eBay account. I guess I forgot to change my password there.

Funnily enough, this never happened in my life as I protect my passwords very well. Amazon sent me that email exactly one day after I registered on expert.ie to buy something. If you register there, they will send you an email of confirmation like any other e-commerce website, alright... but they will f@#$@#ng put your password in that email, "to remind you". Basically they don't encrypt customers passwords, I'm speechless how someone can save raw passwords in a database, when encrypting them costs literally nothing. And I believe there is a connection between registering there and having your email and password published in these lists...

edit: lesson learned, since that happened, I'm not trusting any website with my password, I'm generating one for each of them.