Has your MSE forum email address been spammed.

I've yet to get spam from the email address I use for MSE - and it's my primary address, but then I think I've got a rep round the 'net for harassing the spammers back and reporting them to their ISPs.

Btw, Martin, I take it you meant "ISP" in your insert to the OP rather than "ESP"?

It's worse for me - I've got a Yankee keyboard layout on my laptop - nothing's where it's meant to be

Hello TimothyEBaldwin!

Your email address may have been intercept by someone sniffing internet traffic to/from MSE, you and your email provider. Or your email provider may have a security problem.

Yes, that is always a possibility, except in my case, apart from an email two years or so years ago, I've not had any emails from MSE...apart from the Spam message that popped up at the same time as the others.

I'm therefore almost 100% certain that the problem was not that.

Several people who use unique email addresses for this Forum have all received more or less the same Spam at more or less the same time. This, I regret, does look like an email list has been compromised.

The important issue is to work out how, and plug the hole.

FUWW

It's probably going to be hard to trace down. The forum could have been misconfigured for a short period of time or had a bug at some point that exposed all the e-mail addresses to to the web e.g. this one:

http://www.vbulletin.com/forum/showthread.php?t=258527

Or maybe there is or has been a hole in the database and someone's got a spam harvesting technique that exploits it. Probably wouldn't have to log detail to be able to spot that.

I understand that the MSE enquiry relates specifically/particularly to those members with an e-mail address used uniquely for here - which does not apply to me - but for the record I had a "DHS - from the FBI" with an .exe file attachment today, similar to those noted by other posters.

Hi folks,

Thank you for all your help and information on this.

After spending quite a substantial amount of time investigating, we have not been able to find any obvious loopholes or record of penetrations of our security.

However, the number of reports by users with unique e-mail addresses makes it difficult to argue against the fact that at least some of our Forum e-mail database has fallen into the hands of spammers.

Based on what we’ve found, we can only surmise two possible ways of this happening.

The former we can do little about. As to the latter we have taken a number of steps to beef up our security and lock down access to outsiders. This is the first time anything like this has happened in MSE six years, we don't take things for granted, and we do take this seriously. Obviously we’re not going to publish here the extra security steps taken as that would defeat the point in them.

Thankfully, we only keep registration e-mail addresses, so the downside problem is relatively limited, although we do understand that the increase in spam is annoying.

We would just like to reiterate at this point that we would never voluntarily share our users personal information with anyone else so for this to happen is frustrating and we’re trying to ensure that it doesn’t happen again.

Please accept our apologies for this happening and thank you to the users who brought it to our attention and do let us know if you suspect anything like this has occurred in future.

Webby