With all the phishing attempts that come through my email accounts on a fairly frequent basis, I had to do a double take when this legitimate warning from Amazon.com came through in the early morning hours of February 19, 2016.
The title of the email was “Your Amazon password has been changed”, which sends up the phishing red flag right away.
However, the content of the email and the fact that it didn’t ask me to log in via any provided links or reply back with any information made me believe that it might be legit. After some searching, I was able to verify that this was indeed a legitimate email from Amazon.
Here is the exact email for your information:
At Amazon we take your security and privacy very seriously. As part of our routine
monitoring, we discovered a list of email address and password sets posted online. While
the list was not Amazon-related, we know that many customers reuse their passwords on
several websites. We believe your email address and password set was on that list. For your
security, we have assigned a temporary password to your account.
You will need to reset your password when you return to the Amazon.com site. To reset your
password, click “Your Account” at the top of any page on Amazon.com. On the Sign In page,
click the “Forgot your password?” link to reach the Amazon.com Password Assistance page.
After you enter your email or mobile phone number, you will receive an email containing a
personalized link. Click the link from the email and follow the directions provided.
Your new password will be effective immediately. We recommend that you choose a password
that you have never used with any website.
After satisfying my curiosity on the legitimacy, I then went to Amazon.com (typing the url into my browser) and sure enough, when I went to log in, I was told that the username/password I had entered did not match.
So, I simply followed the instructions by clicking the “Forgot your password?” link and set up a brand new password.
Although I wish I could have the exact location where Amazon allegedly found my compromised info on a list, I didn’t bother asking because I have a strong feeling that is not information they would be willing to share for security reasons.
My curiosity not satisfied, I decided to do some quick research to see if I could actually track down more information on whether my email was compromised and how.
I quickly came across an article on Forbes titled These Sites Tell Which Of Your Accounts Have Been Hacked written in April 2014 which recommends a couple sites.
I decided to give the first site mentioned a try. That site is haveibeenpwned.com and here are the results I received when entering my Yahoo address that was linked to my Amazon account.
So it looks like my email info was compromised at the very least back in October of 2013 when 153 million Adobe accounts were breached. If this is the only compromise, I have changed my passwords several times since then and hopefully there are no more current breaches out there with my account info hanging in limbo.
Man, I hate hate hate hate hate HATE hackers. As if we don’t all have enough to worry about in this world.
The article and sites mentioned are worth a look.
Feel free to let me know if your info has been compromised and how(if you know).
Stay safe out there.