I got hacked last night

[andrewducker]

I woke up this morning to two notifications from around 2am from Moonpig.com* saying "Thank you for your order!" - neither of which I'd made.

Checking into it further, each order was for £53 - a card plus a giant candle, sent to an address I didn't recognise.

Presumably part of a scam (which I'd heard of somewhat vaguely) where expensive items are delivered to a third party, and then the scammers collect them from there, before selling them on second-hand.

The Moonpig helpline didn't open until 9:30am, but I got straight on it then, they were incredibly helpful, and by 9:35 it was all fixed with both orders being cancelled. Quite impressed with their service.

And it serves me totally right for having a password that I hadn't changed in over a decade. Because I hadn't considered that "that place I order birthday cards from" was a threat.

*They make custom cards and send them out automatically. They also sell candles, flowers, and other gifts. They're really useful for birthdays, etc.

Comments

[myka]

wow ok. I changed lots of passwords after getting notification about an lj password breach in May (I think it was May)

[hilarita]

That's one of the advantages I'm finding with a password manager - I can get it to run a check on anything that's old (and hence may not have enough entropy, even if it's not been compromised in any other way).

[andrewducker]

I've been avoiding doing so, because I hadn't found one that worked that well on my phone (Firefox on Android) and my home desktop and my work desktop, keeping them all in sync.

Is there one you'd recommend?

[poshmerchant]

I use Lastpass with Firefox on Android. It's not as convenient as on the desktop but it works. I use a separate app for Lastpass rather than the extension, I think.

[ckd]

I'm quite happy with 1Password; it syncs between my phone, tablet, desktop, and laptop. (My parents subscribe to the family plan so that they can share important passwords with my brother and me, so it's also syncing the shared vault with their devices.)

I'm using the iOS version on my phone rather than the Android version, but I expect the latter would work as well as the ones I do use (which is very well indeed).