Blueyonder email account compromised

No general hacks reported at the moment, but emails used for many years are subject to hacking if the user has used the same password on different accounts. Could your father have done this?

Can you change his password?

https://www.virginmedia.com/help/broadband/manage-email-account

---

ConcernedSon wrote:

Today it seems scammers from Nigeria accessed my father's blueyonder email account.
I deduce this from the mail hedder containing:

X-Originating-IP: 102.88.111.43

---

if that header is from an email message sent to your Dad, apparently from his email account, then you can check whether his email  account has actually been hacked by looking for this section of the header:

X-Authenticated-Sender: xxxxxxxxxt@blueyonder.co.uk

1)  If that section reports your father's email address as being the authenticated-sender then his account has definitely been hacked. That header is saying that the email really was sent from his Blueyonder email account using his email address and password.

2) On the other hand, if that X-authenticated  section is missing or has a different address in it,, then the From address in the email has just been spoofed (faked) by a scammer to make it look as if the email was sent from his email account. 

In that case the scammer has not accessed your father's email account even though they may have quoted a password in the email itself. They gather the passwords from third party sites that have suffered a data breach.

Coenoby

Hello ConcernedSon,

Welcome to the Community and thanks for taking the time to post here on the forums. I’m sorry to hear of the issues that your father is having with his email account. Have you been able to get the issues resolved with the assistance of the community members?

Kind Regards,

Steven_L