Warning to anybody Leaving Virgin media

ritzman

I thought people should be aware of a large security issue if you leave or have left Virgin media.
My SiL left Virgin media about 12 months ago, as most people had a Virgin media email address. She has just found out this email address is still active and that someone else has gained access to this account (probably a data breach from other org as her address is on pwned site). So you would think easy just change your password and sorted. No not with Virgin as you have left them you are no longer able to change your password, so this cretin has managed to access her Facebook and con some of her friends out of over £1000!!!
Virgin have said emails should be cancelled after 90 days but reality can remain open for years.
We are seeing password resets coming through for all sorts of accounts not setup by SiL and email address has been added to spamhaus, but Virgin don't see any urgency to close at say will take at least a week and might not even be done then. In the mean time phishing spam and account resets still on going and risk of more people losing money.
If you have had a Virgin media email account I would check if still active and get it closed before you are victim.
If anyone has advice of who to raise this to, as VM customer service don't really see urgency.

JJ_Egan

User can reset passwords before leaving not hard to do .

Exactly the same with other ISPs email as they dont close individually but in batches .
Likewise all contact emails facebook etc can be deleted .

ritzman

But users can't reset password after leaving, so if compromised after nothing can be done.
Old email has now been changed on Facebook now after bit of a fight.
Just making people aware of security issue.

JJ_Egan

Problem is as you say users need to take care of security before the event .

ritzman

That doesn't matter. If you account gets hacked there is nothing you can do. That is the issue and if you think your account is long gone then it might not be.
Do you think it's fine that you can not secure your account after it's been hacked?

techquest

ritzman wrote: »

But users can't reset password after leaving, so if compromised after nothing can be done.
Old email has now been changed on Facebook now after bit of a fight.
Just making people aware of security issue.

It's a good wakeup call to anyone who's interested, also shows how easy it is to get scammed by such oversights. So I think a useful post.

PDC

I think email accounts not being removed is common across most isps.

I can, or could last time I checked, access an o2 email account which I left several years before, even after they sold their ISP business to sky and sent out emails at the time saying the email access would end.

Is unfortunate the password can't be changed on your friends account though.

ritzman

I can understand partly accounts staying open for a bit, but locking people's ability to change the password once you leave seems ludicrous.
This is Virgins process, its not a one off.

JJ_Egan

As said its the process of most ISPs .
You can complain to OFCOM .

ritzman

We have been in contact with Action Fraud most of the afternoon and they couldn't believe this was taking place and that would take so long to close account. We now have crime reference number and they are investigating Virgin for their failures.
Today there has been 450 password resets mostly from. Fortnite.

techquest

Good to hear your getting somewhere and hopefully VM will get a backlash for it. Though it's not just VM, all ISP's seem to have a 90 day time frame set for a simple process.