Hacked, but does it matter?

[Simpo Two]

15+ years ago I opened a Twitter account in my (then) trading name, just because I thought I ought to have one and it might be useful one day. In fact I never used it and am now retired. I've never posted anything on it.

This morning I got a few e-mails appearing to be from X talking about unusual logins, change my password etc, and as these things are usually phishing e-mails I ignored them. Half an hour later out of curiosity I tried logging into my now-X account and indeed, neither my password or mobile number worked. So it looks like some teenage bandit has stolen my account.

Question is - as I never used it and don't actually want it any more, does it matter?

[Ronstein]

Depends on (mainly):

Have you used the same email/password combination anywhere else?

Depending on your business, could it be used to damage or discredit it?

If yes to either or both, it's likely to be a problem.

[Simpo Two]

Thanks for the reply.

'Have you used the same email/password combination anywhere else?' No, but similar ones.

'Depending on your business, could it be used to damage or discredit it?' Can't see how as I've retired, though I still have the domain name.

[harryt]

Don't do Twitter / X but if you had to give any personal information when you created the account then your hacker now has this.
If it's totally anonymous or now irrelevant unconnected data then fine.
I'd probably still report it just in-case your hacker posts some plod arousing crap.
Serving 31 months for a hacker's wad would be annoying.

[butchstewie]

I'd be changing my email password and ensuring 2FA was set on it.

Shouldn't be needed but absolutely zero downside and whilst you'd like to think this is random you never know.

[Bill]

Simpo Two said:

15+ years ago I opened a Twitter account in my (then) trading name, just because I thought I ought to have one and it might be useful one day. In fact I never used it and am now retired. I've never posted anything on it.

This morning I got a few e-mails appearing to be from X talking about unusual logins, change my password etc, and as these things are usually phishing e-mails I ignored them. Half an hour later out of curiosity I tried logging into my now-X account and indeed, neither my password or mobile number worked. So it looks like some teenage bandit has stolen my account.

Question is - as I never used it and don't actually want it any more, does it matter?

Has it been stolen, or is it just locked because someone's had a go?

[bad company]

I’d respond to Twitter / X saying that your account’s been hacked. Otherwise he could say anything on that account and it could be attributed to you.

[Simpo Two]

harryt said:

I'd probably still report it just in-case your hacker posts some plod arousing crap.

Thanks, I did that just now and asked them to close the account.

butchstewie said:

I'd be changing my email password and ensuring 2FA was set on it.

My e-mail has a completely different password so should be OK. No idea how to set 2FA and having to get a text every time I want to use e-mail would be really tedious.

Bill said:

Has it been stolen, or is it just locked because someone's had a go?

Not exactly sure, I put my phone number and/or username in and just nothing happened.

bad company said:

I d respond to Twitter / X saying that your account s been hacked. Otherwise he could say anything on that account and it could be attributed to you.

Have done. To answer Bill's question I went to have another look...

It's OK, I'm back in! Had a number of e-mails from X:
Regain access - Hacked or compromised, We're writing to let you know that we're unable to verify you as the account owner.
Your X confirmation code is.....
For security purposes, your X account has been locked... Your account may have been compromised by a website or service not associated with X.
New login to X from Chrome on Windows (that was me)
Your X confirmation code is....
New login to X from Chrome on Windows (that was me)
Regain access - I need to reset my password... We sent you instructions to reset your password for the X account associated with your email address

Not sure what happened but it all seems normal now, and I can continue not to use it

[butchstewie]

Who's your email provider?

It shouldn't be every time it should be "every time you sign in" and sign-ins are usually cached for several weeks sometimes longer.

Events like this can be prompt to think about this stuff and take some basic steps to put yourself in a better position or you can assume you should be OK and you probably will be. Each to their own

[Simpo Two]

butchstewie said:

Who's your email provider?

Greenby, who just took over from Plusnet. Terrible to start with, just about OK now.

I also have some of my own domains so (a mate of mine) can set up direct e-mail from those, I believe. If Greenby get any worse that's what we'll do. As you can tell it's not an area I'm expert in.

[butchstewie]

They seem to get mixed feedback.

I'm a big fan of Gmail. If you don't already use them they're worth a look. You should be able to get the two linked and you won't get much better than Gmail for filtering and security.

It's hard to do email well/right which is why a lot of ISPs have now realised it's just not worth it especially when they make no money from it.

[durbster]

Something like this happened to my Twitter account a few months after I'd uninstalled but I already locked it down when Musk took over, as I expected them to have security breaches given he clearly didn't have a clue what he was doing.

Considering they're one of the only social media platforms to have been losing users in recent years, maybe they're prompting people to login just to boost the metrics.

butchstewie said:

I'm a big fan of Gmail. If you don't already use them they're worth a look. You should be able to get the two linked and you won't get much better than Gmail for filtering and security.

Using Gmail is a bit like being hacked, except you're volunteering to give all your personal information away instead

[butchstewie]

There's usually a balance to be struck between security, usability, and practicality.

I think for most people they'll be in a much better position on all fronts with a Gmail account than they will some random pop3 or imap provider.

Plus most of the people you're sending or receiving emails to/from likely use the big names anyway.

Each to their own of course

[Simpo Two]

I tried a gmail account a couple of years ago but e-mails disappeared after 30 days; maybe I had the settings wrong. But I don't like webmail in principle, I like my stuff in my PC on my desk, not on the end of an internet where you have to download it every time to look at it.

[Ozone]

Simpo Two said:

Thanks for the reply.


'Depending on your business, could it be used to damage or discredit it?' Can't see how as I've retired, though I still have the domain name.

In the current political climate, are you likely to visit the US in the next few years? If the account is linked to you with posts that are seen as 'unfavourable' may cause entry problems to the US.

[Simpo Two]

Ozone said:

In the current political climate, are you likely to visit the US in the next few years? If the account is linked to you with posts that are seen as 'unfavourable' may cause entry problems to the US.

No. But I don't do politics on social media and I'd vote Republican anyway so no problem I think.

[NorthDave]

Simpo Two said:

No. But I don't do politics on social media and I'd vote Republican anyway so no problem I think.

I think the point is that someone else is now posting on your behalf. If they post something slightly terroristy or anti-donald, and they can link that account to you, then you are in a fair bit of a pain.

[Scabutz]

Simpo Two said:

'Have you used the same email/password combination anywhere else?' No, but similar ones.

If your X account really was compromised this is likely how it happened. People say their FB/X etc accounts have been "hacked" but they haven't. The security on those systems is top notch and no one is busting the authentication or brute forcing your login details. Likely you've used the same or similar password elsewhere on a site with ste security and the password has been leaked, they are then using that to try various sites to see if they can get in with that password or a variant of.

If you go other logins elsewhere similar to the X account I would be changing that sharpish to something quite different