Password reset - different name (Investigating)

[aaaanditsgone]

Hi,

My virgin media account password has been reset by someone else several times since last Friday. Shortly after it happens, I lose access to my email and have to reset the password to regain access. I have also changed the recovery answer to a long random string which didn't help.

Is there some kind of exploit with the password reset system that allows an attacker to bypass the recovery question? The last two password reset emails even show a different name to the one from my account.

Thanks

[MOD EDIT: Currently under investigation. Multiple threads merged]

[maas]

We are getting the exact same thing. Happened twice today, an email from Virgin saying password has been reset addressed to Roger, at which point you disregard it as a spam message, and then your email fails authentication and you can no longer log into Virginmedia.com

[nbaker]

It's certainly looking like a hack.

I have no way to get in to change my password.

[geminitrading]

Same thing keeps happening to me.

Is my email account compromised?

Any answer from Virgin media?

[pjh]

Ah, ok. That is bizarre. So not only changing the password but also the name on the account?

[ALF28]

It may be possible your email was hacked, and your password was leaked somehow, this would prevent access to the email account as you have described, but you have managed to recover the account.

It is wise to use a strong password using upper- and lower-case letters and numbers, and many digits, I use 20.

At the same time as a password change, also update the security question in the online virgin media account settings.

If someone has been in your email check for any suspicious activity/email as they may have used the email to hack other linked accounts.

It may be wise to switch to another email address if you suspect the email has been hacked, although if you have secured the email that will help.

There is help available for email enquiries if you contact virgin media on the free number 150.

I would also check the router/hub password settings page is working by logging into them and set your browsers not to save passwords.

Hope that helps, but advise you to still contact virgin or a forum member on the community to check the account is secure.

[oakleyd]

My Virgin a/c was was hacked 3 days ago. I have reset pwd and changed secure questions etc, but someone keeps changing my pwd. I call "tech support" yesterday and got a flat denial. Changed pwd again. Today, I cant connect to SMTP as my pwd had been changed yet again, but not by me. Called "tech support" yet again, another 30 minutes on the phone. This time the phone jockey admitted that "yes it has been hacked but doesn't know how?" He said he will notify IT Support. How is this even possible? Is this the most insecure security in the world? I use strong pwd with challenge questions. Why the hell doesn't Virgin implement 2 Factor Auth on these accounts?

[Kadrevex]

yes! Im having the same problem!

I cant even reset my password. I phoned up support and they reset my password and then i changed it again. But 5 minutes ago my password has been changed once again!

[Minimitts]

Thanks for the reply, that was my first thought. 

What I find odd was 2 emails from VM with another persons name 12hrs apart (6am and 6pm ish). Yet, when I changed my password. It still has the acct in my name (not the person from the emails).. I will contact them tomorrow to see what they say.

cheers

[Kadrevex]

Same thing happened to me. I got the same email for PHILIP.

I phoned support and they reset it for me. But its just been changed once again.

[oakleyd]

Yes its ridiculous. I had to do the same thing. My guess is that when you sign out, it only signs you out of that session. So if someone has hacked the account, provided they stay signed in, they can just keep changing the pwd and sign in again using that. When you sign out, it should sign out ALL sessions. There should be 2 factor auth on ANY pwd change. I'm seriously considering leaving Virginmedia over this, as its really really poor security.