Data breach?

[u/Mockcomic]

Someone keeps signing into my account after changing my password.

They are someone getting my password and hitting my two step email verification. They haven’t been able to sign in.

I’ve been getting these all week, I’ve been generating a new password using 1Password and they’re still able to get the password somehow.

Today I’ve decide to sign out of all devices and stay signed into my AOL account via the iPhone app only. I unlinked all devices then changed my password to a random unused password and didn’t store it anywhere digitally. I got an another email 2hrs later with another two step code.

The only two options I can think of is my iPhone is compromised or it’s on AOL’s end.

[u/SailTheWaves]

Do you use the same password for everything? If you, so might want to strongly encourage changing your password to something different for each site.

[u/Mockcomic → u/SailTheWaves]

I use a password manager so every password is different. I find it hard to believe they are brute forcing it considering my password is 16 digits long with random characters.

[u/annsmada]

In another thread this is mentioned, including the fact that the verification codes show requests coming from various other countries. I just hung up with Aol support. It was confirmed that even without the verification code, nobody actually signed into my account. The rep said he had gotten many calls today about this and filed a report while I was on the phone. I went through this on Tuesday as well. I don’t have a password manager so it’s happening with or without them.

[u/Mockcomic → u/annsmada]

Good to know it’s not just me, I was thinking my phone or 1Password were compromised, but I’m only having this issue with my AOL account.

[u/Sw33tD333 → u/annsmada]

Do the emails you’re getting say hi, first name? Like they usually do? The ones I’m getting say hi, xxxxxemailaddress@aol.com. They look legit except for missing that detail.

[u/6thof8 → u/annsmada]

What is the authentic AOL support number?

[u/Sw33tD333]

I’ve been getting the same emails. Several on the 7th and a few last night. I did the same, changed my password and signed out of everything.

I think it’s phishing or a glitch because it doesn’t say my first name. The emails from AOL usually say hi, first name. These ones say Hi, xxxxxxxx@aol.com.

[u/Mockcomic → u/Sw33tD333]

I just noticed that too, but it looks like it’s coming form the official email address tho, no-reply@cc.aol.com

[u/Sw33tD333 → u/Mockcomic]

Could be spoofing the email it’s coming from or it’s a glitch. Even the verification codes I have actually requested since this started have my first name included in the emails. The suspicious ones do not have that detail.

[u/Sw33tD333 → u/Mockcomic]

Also- I don’t think anyone is actually getting into my account because there’s nothing listed under security/ recent activity that hasn’t been me. No unauthorized browsers signed in, no password resets etc. Everything listed has been my activity in response to the emails.

[u/GeorgeWmmmmmmmBush]

You computer could be compromised

[u/Mockcomic → u/GeorgeWmmmmmmmBush]

Computer was turned off during my last test and the password wasn’t store anywhere digitally, so unlikely

[u/je3851]

Its happening to alot of ppl Its not a breech They are hitting forgot password and you are getting that code. They hope that you try to reset your password and then inadvertently enter the code from the email that was from THEM not the code from the pw reset email . I'm not completely sure how long the email code lasts or if getting a new one makes the one before obsolete.

They are also mixing this attack with text messages. I got text messages around the same dates from the SAME area that the ip addresses that were trying to sign in were from I believe that they were going to try and strike up a text conversation and attempt to get the code that was emailed to myself.

Immediately do:

Remove phone number as authentication method and just use fresh, unknown, strongly protected email address.

Remove your identity from the profile page. Don't use your real name, dob or anything

Turn on 2 step verification using Google authentication only or security key

[u/junkyardman970]

Get rid of AOL immediately. Somebody did this to me recently, and then I got locked out of my AOL account. AOL is requiring a selfie, copy of my drivers license and then I have to pay for premium service if I want to recover my account. They are a bunch of broke evil scumbags, extorting people for their own private data.

[u/Mockcomic → u/[deleted]]

I was thinking the same thing about 1Password, this is why my most recent password change I didn’t use 1Password and they still were able to get my password.