Consumer Action Group Hacked!

Paul_Varjak

I have a domain name which allows me to use limitless email addresses. So, I use a different email address on every site I am registered. I have only been on Consumer Action Group a short while and only made a few posts. I have NEVER sent any emails from the email address I used to register on this site.

Today I received a spam email to the email address I registered on CAG. That email address is used on no other site. Here are the contents of that email (I have anonymized emails address and links)



Pamela Cook <pamela.cook@ifreemart.com>
18:25 (5 hours ago)

to consumeractiongroup@xxxxxxx.xxxx

Hi there,

We're looking for honest people to work from home. we're currently gathering a team of online talents to Improve a betting system. You will be required to work up to 8 hours a week. Work fee starts at £5,000 per month
before bonuses.

Nominees must have the following:

1. High school diploma
2. Option to work from home
3. Proven successful experience with http://ifreemart.com/b/click/1571/149346064/xxxxx.html Must generate at least £500 within a week, in either real or play money with a initial sum of no more than £54 at a time.

Good luck,
Pamela Cook,
HR Manager


To unsubscribe from our mailing list click here http://ifreemart.com/b/unsub/1172/149346064/xxxxx.html

Hanky_Panky

Wouldn't put anything past that bunch on CAG.

Mostly to55ers trying to get away with not paying what they owe on technicalities. Cost us all a lot of money - TO55ERS ! :mad:

hunters

Out of interest why give the spam a larger audience by posting it on here?

ihateyes

Hanky_Panky wrote: »

Wouldn't put anything past that bunch on CAG.

Mostly to55ers trying to get away with not paying what they owe on technicalities. Cost us all a lot of money - TO55ERS ! :mad:

Well i browse both sites and what i find is that site is empathetic and sympathetic towards users....

I find people asking for here get flamed, for being in the position.

infinitelybig

Like the OP I am also receiving spam to my CAG email address despite it being registered only with CAG.

The first was on 20/6/2013

linking to

wfifr.com/b/click/1528/*********/13513.html

and the second earlier today

linking to

cntcinc.com/b/click/1594/*********/13513.html

I never click on suspicious links like these and recommend others not to do so either.

Also like the OP I have my own registered domain which I use purely for email and nothing else. I use a different email address for every site and organisation that I am registered with.

My email addresses are in the form of a random set of characters and numbers for example g5jcgTdF67v1 @ myowndomain.com

Whilst it's not impossible for the addresses to have been hacked by brute force, I think that's highly unlikely.

I think it's much more likely that either CAG security on their email accounts has been compromised allowing a spammer access to the email address list, or perhaps worse, that CAG know about this and are allowing the email addresses to be used for spam.

In the first instance I plan to change my CAG email address and to see what happens. If that fails to stop the spam - which I HATE - then I will simply delete the addresses from my active accounts.

Exile_geordie

Ooh that doesnt sound good but I notice both posters who have had spam email both own their own domains through which they use emails on.

Ever thought it may have been your domains that were hacked due to your lack of security or someone hacking your host?

Just a thought as in 24 hours no one else who uses CAG has come on to say they are recieving spam from their own email addresses. I know I havent and I also am registered on CAG.

infinitelybig

Exile_geordie questions whether the domain has been hacked.

That's a interesting question.

If that was correct it is likely that spam would be being sent to more than one of the nearly one hundred email addresses I currently have set up.

But the fact is, the only email address currently receiving spam is the one that I *only* use for CAG.

And unlike the OP the only reason CAG have an email address is so I can view their forum - I have never posted there.

For that reason I think it far more likey that the breach is on the CAG side.

keyser666

http://www.consumeractiongroup.co.uk/forum/showthread.php?394727-CAG-email-database-may-have-been-hacked-beware-spam-emails

Paul_Varjak

Exile_geordie wrote: »

Ooh that doesnt sound good but I notice both posters who have had spam email both own their own domains through which they use emails on.

Ever thought it may have been your domains that were hacked due to your lack of security or someone hacking your host?

Just a thought as in 24 hours no one else who uses CAG has come on to say they are recieving spam from their own email addresses. I know I havent and I also am registered on CAG.

In my case I would say no. I used a unique email address on Consumer Action Group only. That email address does not appear anyway within my domain account as it is a receive address only - I can simply use anything in front of my domain name to create a unique email address (receive only).

Paul_Varjak

I had an email from the owner of Consumer Action Group...

Marc_Gander wrote:

thanks for this.

I'm afraid that we think that we have been hacked recently and emails have
been taken. There is a thread about this on the forum.

I'm very sorry that you have been bothered by it.
We do our best but it is difficult to stay one step ahead. This is the
second time it has happened in 7 years.
I understand that it has happened to other forums including MSE

We are investigating to see what lessons can be learned.

Regards

Marc Gander
CAG Admin

Paul_Varjak

hunters wrote: »

Out of interest why give the spam a larger audience by posting it on here?

The links were anonymized to prevent that.