"Your email address has been stolen" email from Garlik Datapatrol

martin2345uk

My mums just sent me a panicky email as she's received a mail with the above subject from this Garlik company saying she needs to log into to Datapatrol account to check what's happened.

My first instinct is that it's a scam but this company does seem to be legit, and well it wouldn't be out of character for my mum to sign up for stuff without knowing what she's doing.

Any thoughts..?

Fightsback

I always treat this kind of mail as potential scam, never click any links in the email and if your mum wishes to confirm the information then go directly to their website through a browser. Fishing scam attacks go to great lengths to appear as if they are from a genuine company.

http://www.garlik.com/datapatrol

Garlik is owned by Experian

https://en.wikipedia.org/wiki/Experian

Recently there have been widespread releases of personal data from services such as hotbox, linkedin etc and that your mum's email may be on that list.

Find out if your Mum has genuinely signed up for the service.

martin2345uk

Thank you. What does it mean exactly if your email address gets stolen?! If you change your password wouldn't that stop people using it?

Fightsback

martin2345uk wrote: »

Thank you. What does it mean exactly if your email address gets stolen?! If you change your password wouldn't that stop people using it?

People are often lazy using easy to crack password hashes or reuse the same password for everything.

for example:

http://arstechnica.com/security/2016/08/dropbox-hackers-stole-email-addresses-hashed-passwords-68m-accounts/

martin2345uk

Yeah I need to get her to use a better password!!

Oh, turns out she did sign up with them a long time ago!!

victor2

Garlik services are now offered free with DirectLine home insurance.
I gave it very limited information, as I'm not prepared to dump all my personal details unnecessarily into a web server somewhere, and it came back with a warning that a LinkedIn security breach could have compromised my email. That breach was in 2012, although reports are that the hacked data has appeared for sale this year.
It can be a pain, but I use different passwords for every site I register with (including Garlik) - and different email addresses in many cases.

Garlik gives you the option to input all kinds of personal data - mobile phone number, NI number, passport number, bank account and credit card details. That type of information would be a gold mine for hackers and identity thieves. You have to have absolute faith that they keep your data secure...

jmc160

martin2345uk wrote: »

Yeah I need to get her to use a better password!!

Oh, turns out she did sign up with them a long time ago!!

Not just one password, all passwords should be different..

Check out password managers like LastPass or KeePass. Both have free options and allow you to generate and set up very secure passwords. You don't have to worry about remembering them, just use the extensions to autofill when visiting the sites.

Also, you can check if your details have been compromised by entering your email address here:
https://haveibeenpwned.com/

forgotmyname

I tried that pwned link before and it found an old spammy email address and linked it to myspace, but it gets less spam that ones ive used on the comparison websites.

J_B

jmc160 wrote: »

Also, you can check if your details have been compromised by entering your email address here:
https://haveibeenpwned.com/

Then .... when I get a positive answer .... what then??

Bigphil1474

If you get a positive answer, log into that account, change your password, reset if applicable.
My Netflix account got used by a-n-other (some bloke in Belgium apparently) earlier this year because my Myspace account from years ago that I'd stopped using had been compromised, and unfortunately had the same e-mail and password. Logged into Netflix, reset devices, changed the password, and no longer an issue. The blighter had even set himself up with his own user profile so it wasn't hard to spot. Mind you, in the early days I used to use the same password for everything. These days I use sticky notes to record all my passwords so I don't forget them, and nobody can see them unless they are logged in as me - saves me having to remember too many.

J_B

Bigphil1474 wrote: »

If you get a positive answer, log into that account, change your password, reset if applicable.

Sorry - confused dot com - log into my email account and change the password???