Have i been pwned?

[Roderunner]

Hi Folks, I went to this website:-

RR.JPG

to find to my horror, my main gmail address has been compromised twice. The first time I found this, I changed my password and have not had any trouble so far.
I would now like to close the gmail account but keep the settings I have made and transfer them to a new account. Keeping my contacts is the easy part, it's the remainder I am worried about.

[HansV]

Does Move or Copy Mail From One Gmail Account to Another help?

[Roderunner]

Hi Hans, once again, thanks for your speedy informative response. I don't have time today to read any of the link's data. I have realised it will be bigger than I originally thought. I have over 30 sites to open a new account on but will have to keep the old one for it's contents. Plus over 80 contacts to get my new address.
Isn't life fun.

[HansV]

By the way, was your Gmail account itself hacked, or a site where you used your Gmail account to register? If the latter, that would only pose a serious problem - apart from that specific site of course - if you used the same password on that site and on other sites.

A long time ago, I joined the Malwarebytes forum to ask a question, using my Gmail address. Malwarebytes was hacked some years later, but since I use a totally different password for each site, the problem was contained. I only needed to change my password for the Malwarebytes forum. There was no need to abandon the Gmail account.

[Roderunner]

Here is the info I was given:-

RR.JPG

I was warned by Avast and know for certain I changed my 2 passwords (same one for both Forum & Account)
-
In Utorrent, I have not used any of its features since file sharing ended.

I am guilty of using the same Username on many sites, a different mail address occasionally but never the same password.

[HansV]

The same username is not a problem since you use different passwords.
The breaches described here are of the same type as the one I described for Malwarebytes. Your Gmail account itself is not compromised - only the usernames on those two forums.
So there is no need to abandon the Gmail account!

[Roderunner]

So there is no need to abandon the Gmail account!

-
You have just made an oldish man very happy.

emoticonparty.jpg

[garbsmj]

Thanks! I had no idea some site I hadn't used for years got hacked. So changed everything.

[BobH]

If one should find that one or more of his email accounts has been 'pwned' what should he do?

[HansV]

That depends. The main thing is that you change the password at the hacked site and at all other places where you used the same password.

- If the email provider itself has been hacked, you should immediately change the password of your email account, and of all other places where you used the same password, regardless of the username. You don't need to abandon the email account, unless you have indications that your email messages have been tampered with; in that case it'd be best to start a new account.

- If a site was hacked where you used the email account to register, you should immediately change the password you used at that site, and at all other places where you used the same password, regardless of the username. But you don't need to change the password of the email account, unless it was the same as the one you used at the hacked site.

So the impact is minimal if you use a different password at each site.

[BobH]

Thank you, Hans!

I never use the same password for more than one thing. I'll have to investigate what sites were compromised to see which ones need to be addressed.

[StuartR]

Also be wary if you use a theme to define passwords. Like Mon8769 Tue8769 etc. You must use completely different passwords to be safe

[BobH]

Thanks, Stuart.

I use a password generator (KeyPass) to generate long, complex passwords containing spec. char. upper and lowercase and numerics.

[StuartR]

I use a password generator (KeyPass) to generate long, complex passwords containing spec. char. upper and lowercase and numerics.

That's what I do too, it is a good idea.

[Jay Freedman]

I set up a domain watch at https://haveibeenpwned.com" onclick="window.open(this.href);return false; for the subdomain that includes my website and a handful of email addresses. It notified me that the address sales@<my domain> appeared in a breach list. The only problem with that is that the address doesn't exist. Some creative hacker must have grabbed the domain name from somewhere and assumed that all websites have a "sales@" address. Of course, spammers don't really care how many of their messages bounce, but I hope they spent a lot of money for that breach list.