Recently hacked. Confused about it all. Please help me to understand.

ouraggie

hi. Please be kind, as i am out of my depth here and need help to understand what is going on. Sorry its so long. I am desperately trying to understand what has happened.

The other day i was hacked. I suddenly got several texts from various companies saying “you requested to change your password “. I didn’t. I ignored them. 

Was that wrong?

Next, my hotmail account started doing strange things. My inbox of 2,000+ emails vanished. In my sent items were dozens of spam emails from “me” to different yahoo addresses,Tinder messages in Chinese, etc. 
I was then locked out by Outlook due to suspicious activity on my account.
The next day I eventually managed to verify my account, change my password and regained access. Still no inbox. 

Is my account still being accessed or is it safe now?How can I check?

I then got locked out of my ebay account. A phone call to ebay got me back in with a new password. Meanwhile, in my hotmail account there were some emails from ebay, which had transcripts of several chats that “I” had had on the ebay chatbot, trying to change the bank account that my payouts go to. 

How did they do this? ( ebay password is different to email password).

The next day i woke to find an email from Apple(?) saying someone had used my Apple ID ( i use an ipad) to sign in to an iMAC 25.1”. This was not me. I didn’t click but rang Apple. A very helpful lady helped me to change my Apple ID. I have updated my iOS and now have 2 step verification on my Apple ID.my trusted devices was an iphone 5, which again wasn’t me. This is now removed.
Did/does either of these devices actually have access to what is on my ipad ? How did they get in? 

My Apple ID was nothing like my email password.

I discovered last night that there are recent emails which did not show in my hotmail inbox but if i do a search they appear in the results. eg on a Saturday i get a weekly balance email from Santander. This was only visible if i searched “santander”. 

I then noticed that this santander message  was in my inbox, but bizarrely it was stored in an old inbox folder i had, named Holidays. All my old holiday-related emails were gone, but in this holiday folder were all the abovementioned ebay emails and the santander message. Also, i had bought something on ebay on Sat and the confirmation emails from ebay and Paypal were again not in my inbox but in this Holidays folder. 

What is going on here? 

I have now set up a new email address. I want to make sure it is not connected to the hacked one. I have come across something called alias email. I also have a vague memory of linking my email accounts in some way a few years ago. I am so out of my depth here technologically.  What do i need to do?

thank you for reading this. All help will be gratefully received.

Vitor

>The other day i was hacked<

What computers do you have? You mentioned an iPad but do you have a Mac or Windows machine too?

Any clue as to how? Did you click on a link in an email, download and install an app etc., get a call from 'Microsoft' and let someone check your PC remotely?

What anti-virus software do you have installed?  Try a full scan. Windows Defender lets you reboot the machine directly into scanning which stops malware 'hiding'.

TBH it sounds like someone has obtained a list of accounts/passwords. Do you keep these as a list on your PC?

At the very least, I'd say you need to change all accounts to have different, strong passwords and enable two-factor authentication on all services which provide it (Paypal, Ebay etc). You may need to reformat and reinstall Windows 

grumpycrab

Hi - if strange things are going on in hotmail, your hotmail has been compromised and someone has set 1 or more rules up.  The rules are here:-  disable and/or delete any rules (take a picture first for a record!) when you see them
https://outlook.live.com/mail/0/options/mail/rules
** if you are worried about this link, hover your mouse over it and you'll  see its just a hotmail rules link **
If you are logged into your NEW hotmail there should be no rules.  To check your original hotmail you'll (obviously) have to logout and login again.  
When rules have been checked, change your password (but guessing you've already done that)

ouraggie

Vitor said:

>The other day i was hacked<

What computers do you have? You mentioned an iPad but do you have a Mac or Windows machine too?

Any clue as to how? Did you click on a link in an email, download and install an app etc., get a call from 'Microsoft' and let someone check your PC remotely?

What anti-virus software do you have installed?  Try a full scan. Windows Defender lets you reboot the machine directly into scanning which stops malware 'hiding'.

TBH it sounds like someone has obtained a list of accounts/passwords. Do you keep these as a list on your PC?

At the very least, I'd say you need to change all accounts to have different, strong passwords and enable two-factor authentication on all services which provide it (Paypal, Ebay etc). You may need to reformat and reinstall Windows 

Hi. Thanks for your kind reply.
 I only have an ipad. I think i may have had an old password leaked in a data breach a while ago. That was unwittingly my hotmail password. ( i never needed to type it in, my inbox just opens when i press the email icon.

I don’t keep any passwords online anywhere, just a paper list in a notebook at home.
As you suggest, i will now change all my passwords everywhere and set up the two factor authorisation. 

ouraggie

grumpycrab said:

Hi - if strange things are going on in hotmail, your hotmail has been compromised and someone has set 1 or more rules up.  The rules are here:-  disable and/or delete any rules (take a picture first for a record!) when you see them
https://outlook.live.com/mail/0/options/mail/rules
** if you are worried about this link, hover your mouse over it and you'll  see its just a hotmail rules link **
If you are logged into your NEW hotmail there should be no rules.  To check your original hotmail you'll (obviously) have to logout and login again.  
When rules have been checked, change your password (but guessing you've already done that)

Hi. Thank you for your kind reply. I now understand the hacker set up some rule. I couldn’t see my rules from the link you sent me. Is there somewhere in my hotmail account where i can view these? 

Thank you.

grumpycrab

ouraggie said:

grumpycrab said:...

https://outlook.live.com/mail/0/options/mail/rules
...

Hi. Thank you for your kind reply. I now understand the hacker set up some rule. I couldn’t see my rules from the link you sent me. Is there somewhere in my hotmail account where i can view these? 

Thank you.

That link should work in a browser EG safari on ipad.  Not sure about looking at rules in an app but in browser are under Settings ->  email -> rules

ouraggie

grumpycrab said:

ouraggie said:

grumpycrab said:...

https://outlook.live.com/mail/0/options/mail/rules
...

Hi. Thank you for your kind reply. I now understand the hacker set up some rule. I couldn’t see my rules from the link you sent me. Is there somewhere in my hotmail account where i can view these? 

Thank you.

That link should work in a browser EG safari on ipad.  Not sure about looking at rules in an app but in browser are under Settings ->  email -> rules

Hi again.thank you.  I managed to find the rules and yes, there was indeed one set up saying to forward any emails from ebay to a gmail address ( nothing to do with me) and mark them as read, and also to move all emails containing certain keywords into the”holidays” folder. I have now deleted this rule, thanks to your help. I am so grateful. I had absolutely no idea.
I have also been able to check recent activity on my 3 email accounts. There have been many recent unsuccessful sign ins on the hacked account in the last 24 hours. It seems i am ok for the moment. 

On my second email account there have been a string  of unsuccessful sync attempts from the USA in the last 24 hours. I am not really sure what that means. Were they able to get into all 3 of my accounts when they had access to the hacked account?

grumpycrab

You say you have multiple (microsoft) email accounts now.  Make sure each has a unique non-simple password (in my experience its weak and/or repeated passwords that result in this form of email hacking).  **as well as checking rules also check the forwarding settings.  Using a password manager can simplify password management, but it can also make things more difficult if you're not that computer literate.  Or just write them down and keep updated and keep them somewhere you will not forget.  When you're happy the accounts look ok, then start enabling 2-factor authentication - something else that can also confuse!  but is vital these days.  (using mobile phone - make sure its charged and next to you!)

ouraggie

Thank you, grumpy crab. I have checked forwarding. All seems to be ok. 
I appreciate your help. I feel so unknowledgeable here. 

Heedtheadvice

Not a nice experience...but I would guess you have learned a bit more than you had before, apply it and have reduced the future hacking risk.

fiendishlyclever

You can do the old alias trick where you add an alias to your account and use this to log in instead of your main email (you disable logins from your old email but leave it in place so you can send and receive from it)
https://support.microsoft.com/en-us/office/add-or-remove-an-email-alias-in-outlook-com-459b1989-356d-40fa-a689-8f285b13f1f2