E-mail hacked

[Sarah Clark]

Hi, my e-mail account got hacked this morning and over 350 e-mails sent to people from my received and sent boxes with a drop box attachment and a second containing a pdf. My password has now been changed to stop this but is this considered a breach of data? I have no way of knowing who the e-mails were sent to apart from receiving replies and phone calls who I have told was a hack.

 

[JEREMY HAWKE]

You need to inform those who have been effected of the data breach

 

[ffox]

This is certainly a breach of data.

...over 350 e-mails sent to people from my received and sent boxes with a drop box attachment and a second containing a pdf.

You need to inform everyone that had personal data in the received and sent boxes that their data may have been compromised, and you need to notify the ICO -

https://ico.org.uk/for-organisation...ions-networks-and-services/security-breaches/

The level of your responsibility beyond that will depend on the type of email hosting and how the hacker gained access. If it was through poor authentication management (shared passwords, written passwords. etc then the responsibility is yours. If it is a hosted mail service and the host provider allowed the hacker in through their servers then there will be a shared responsibility.

 

[Sarah Clark]

You need to inform those who have been effected of the data breach

The problem is I don't know who has been affected. They have also deleted the whole of my inbox from before 9.30am this morning. It wasn't sent from my machine so not showing in sent box. Apparently accessed from New Jersey in USA.

 

[jamesandjanie]

What happened, is there an update on the whole story?

 

[ffox]

They have also deleted the whole of my inbox from before 9.30am this morning.

Is there no facility for recovery from deleted items? Is the mail services hosted, or a generic cloud service?

 

[Sarah Clark]

This is certainly a breach of data.



You need to inform everyone that had personal data in the received and sent boxes that their data may have been compromised, and you need to notify the ICO -



The level of your responsibility beyond that will depend on the type of email hosting and how the hacker gained access. If it was through poor authentication management (shared passwords, written passwords. etc then the responsibility is yours. If it is a hosted mail service and the host provider allowed the hacker in through their servers then there will be a shared responsibility.

Hi and thank you. Unfortunately I don't know who the e-mail was sent to as not showing in sent box. Accessed from New Jersey, USA. All my inbox e-mails have been deleted from before 9.30am today so if from my inbox I don't know who is affected other than those who have rung me or replied to the e-mail. The only information would be their e-mail and company details.

 

[Sarah Clark]

What happened, is there an update on the whole story?

I have reported to the ICO and waiting to hear from cyber department.

 

[Sarah Clark]

Is there no facility for recovery from deleted items? Is the mail services hosted, or a generic cloud service?

Hi I am waiting for our IT company to try and recover them. They aren't in my deleted items which is worrying. I have e-mails I have deleted in there but not from the emails deleted from my inbox this morning which go back to last June. Luckily a lot of e-mails are in sub-folders which haven't been affected but there were e-mails from last Friday and over weekend which I have not been able to see.

 

[ffox]

Hi I am waiting for our IT company to try and recover them.

If your IT company host the mail server they should have a log of all activity. This will include incoming and outgoing addresses.

 

[Stitchbob]

I'd suggest getting your IT company's director (or highest level contact available to you) involved. It's possible that *they* are the ones who suffered a data breach, and you are an affected customer. That doesn't remove your own ability to report the breach, but they also need to be investigating at the highest level to figure out what happened.