Potentially WERA Hack?

So I received an interesting email today on a personal email account. They start by giving me my username and password that they have stolen from somewhere. The information they provided was correct for two sites I frequent. One being WERA and the second one is a neighborhood blog site, Nextdoor Sanlando Springs. All other websites I visit have completely different usernames and passwords. First of all I know this is utter BS because I only have one computer and I have never accessed an "adult site" from it and second of all I do not have a membership to any adult website.

The email is very straight forward and I got a good laugh out of its straightforwardness but somehow they have accessed my information from one of these two sites listed.

The email text is also encrypted so when you try to copy paste it adds characters in all of the blank spaces making it difficult to read. Would like to forward this to some authorities but don't know where to start. Was also tempted to respond and request the "so called" video but figured that would open up the door for potentially more hacking.

Thanks,

PS: Tried to rename post but didn't realize you couldn't do that through edit.

 

Had a similar experience with my previous employers email where the hacker threatened to release to my colleagues all of the Nasty adult site surfing information unless I paid $700 bitcoin...which didn’t exist. I encouraged him to go ahead and do it and then went about my business.


Sent from my iPhone using Tapatalk

 

Ignore them, responding just confirms your email is valid.

 

Was (I'm hoping you changed it) your password for this site complex or easily guessed? Have you run your computer for malware lately? Found any malware on your computer lately? Do you log in to many different websites often?

The only reason I say that is because there could be a number of different ways your password could be compromised, not just on WERA's side.

 

Ignore it.

 

All your base are belong to us.

 

Do your porn site browsing from a Mac, and put a piece of electric tape over the camera.

 

https://www.ic3.gov/default.aspx

 

I got one of those several months ago, funny thing is I don't have a webcam on my computer.

 

Thanks. Will be doing this.

 

Funny, I just got the same message today. Had a correct password as well. It doesn't tell me where it got the password from, but there aren't many places I use that password for anymore.

Personally, I just delete the e-mail. I changed from the PW mentioned in the e-mail to something different a while back after I got the first message like this on any account that was important and went to a very very generic, ABC123 type PW, for sites like Wera.

Edit: HA HA, Now that I look at your screenshot attachment, it's the same e-mail but mine didn't originate from Wera as the user name is wrong for this site.

 

Didn’t vertical scope get nailed a few years ago? That may be where the passwords are comming from

 

Our IT department is having a field day with these. The number of employees that have snuck in the IT Director's office, all red faced and shit....asking what to do....hilarious. They want to make SURE he understands that they do NOT frequent those types of sites, and please don't tell their wives/girlfriends etc. Idjits.

 

PASSWORD was my password here for about 5 or 6 years.

Now it's @n+idi$3s+@b1i$#m3n+@ri@ni$m

 

Ohwait... I typed one character wrong above, If you can guess which one you can hack my account.

 

Go to haveibeenpwned.com and do a search on your username. They'll tell you who got breached and how your shit got out there. The ransom email you got is very common and you can expect to see many more over the next few weeks.

 

Since this site doesn't use TLS, every time you log in (happens automatically for most), your username and password is sent in the clear. Anyone with a packet sniffer upstream of you (or in front of the BBS server or anywhere along the path) can read it plain as day.

Mongo, can you ask you IT guy to look into getting a server certificate from https://letsencrypt.org/ ? Its free and would add another layer of protection to everyone that uses the BBS.

 

That a challenge?