J
JohnRSSmithBANNEDrecovery
Guest
Posting here since I was told to here (JohnRSSmith)
Here is the thing: I have not logged in for approx. 18 months I think. I don't remember password and have 2FA active. I casually bumped into Sythe yesterday and found my account was banned. I checked last threads and I realized it was simply hacked.
I am writing this thread not to recover my account (I'd like to, if possible, but I don't think I need it anymore) but to inform you about any possible flaw in your system.
I had 2FA enabled and still it was hacked. I think I was using a random generated password since I have found a very old password recovery in my mail, so it was a unique password which I had not used on any other website.
Even stranger, I found 2 emails for passwortd recovery during the period the hacker had access to my account
[sensitive info see deleted post below]
I didn't notice them since I don't use this email account very much anymore (it's a secondary account for spam). But still, no one had access to my gmail account. I checked the logins and they are all mine. I even have 2FA auth active on gmail.
What I am saying is that it is possible that an hacker could request a password reset and get the link for password reset even without opening the mail, thus being able to reset the password. I have no knowledge about how these things work, I am just basing my hypothesis on what happened with Mailgun and Reddit tip bot.
One last thing, but important one: How much did the hacker steal from victims?
Here is the thing: I have not logged in for approx. 18 months I think. I don't remember password and have 2FA active. I casually bumped into Sythe yesterday and found my account was banned. I checked last threads and I realized it was simply hacked.
I am writing this thread not to recover my account (I'd like to, if possible, but I don't think I need it anymore) but to inform you about any possible flaw in your system.
I had 2FA enabled and still it was hacked. I think I was using a random generated password since I have found a very old password recovery in my mail, so it was a unique password which I had not used on any other website.
Even stranger, I found 2 emails for passwortd recovery during the period the hacker had access to my account
[sensitive info see deleted post below]
I didn't notice them since I don't use this email account very much anymore (it's a secondary account for spam). But still, no one had access to my gmail account. I checked the logins and they are all mine. I even have 2FA auth active on gmail.
What I am saying is that it is possible that an hacker could request a password reset and get the link for password reset even without opening the mail, thus being able to reset the password. I have no knowledge about how these things work, I am just basing my hypothesis on what happened with Mailgun and Reddit tip bot.
One last thing, but important one: How much did the hacker steal from victims?
Last edited by a moderator:
