All details hacked - help/advice needed please.

BOS_Kicked

Hope I've posted to correct thread - please feel free to move it if there's another more suitable.

My wife's details recently seem to have been hacked from somewhere and we're unsure of the best course of action from here.

It started early on Tuesday morning when her email was bombarded with around 200 emails all within a two hour period in the middle of the night (c. 0130 - 0330).

Then on Wednesday, she got a text from the Halifax to say they'd stopped a charge for £300+ from a website that she'd previously used (matchesfashion.com).  When she managed to login to that site an address in California had been added to her addresses.  Card details have now been removed and that account is now closed.

Now passwords for Amazon, Next, Jigsaw, Toast seem to have been changed so she has to fix them, but somebody seems to have access to everything.

My wife phoned the Halifax and her Debit card is being replaced.  We've put a freeze on her Credit card just now.

Anyway, now what?  My father in law mentioned a website where you enter your email and it gives you a list of companies you've registered with (or something like that) but he couldn't remember the site.  Any ideas? It seems more efficient that trawling through emails and bank statements.

I've suggested changing email password, removing card details from all online accounts and checking out as guest or using Apple Pay each time.  Are there any other suggestions?  She's obviously a little stressed at the moment.

Thank you.

[Deleted User]

Change passwords for everything. Clean your computer, phone and anything else you use.

Under no circumstances allow her to enter her details into a site that promises to tell you who she's registered with, or the whole thing will start again.

BOS_Kicked

Deleted_User said:

Change passwords for everything. Clean your computer, phone and anything else you use.

Under no circumstances allow her to enter her details into a site that promises to tell you who she's registered with, or the whole thing will start again.

Thanks - I did think that website seemed like a hackers paradise.

So that I know we don't miss anything - what would 'clean your computer and phone' entail us doing?

MinuteNoodles

On the PC wiping the computer and doing a fresh install. Make sure to back up any important documents to a memory stick first. 

https://www.howtogeek.com/224342/how-to-clean-install-windows-10/

On the phone if it's an Android do a factory reset using the boot menu typically accessed by turning it off then turning on whilst holding the volume down button, using the volume up/down to select Factory Restore on the menu and then the power button to select.

liggerz87

I think the website could be have i been pawned it eill tell you were your email address has been part of a hack

[Deleted User]

That site basically just tells everyone their email address has been hacked.

[Deleted User]

liggerz87 said:

I think the website could be have i been pawned it eill tell you were your email address has been part of a hack

It’s haveibeenpwned.com which is a list of places your email address has been leaked in major data breaches.

liggerz87

I knew was that gabby just forgot what it was haha

Grumpy_chap

Haveibeenpwned tells you that your email was hacked and which passwords they got, but not where those passwords were used.

ciderboy2009

Does your wife use the same password for everything?  It sounds like she probably does.

This is one of the reasons why you should always use different passwords for each site - if you don't then the hackers gain acces to all sites once they've obtained the password.

I've come across examples where the hackers accessed the user's webmail and set up rules to automatically delete emails from various different companies so they never received password change notifications etc.  It may be worth checking for this.