Email Warning of Compromised Account(s)

[Hilary]

My user name is "American." I input the correct password when I received an email from Serif telling me Ukraine-based people attempted to enter my account. This is laughable for so many reasons, but I'm not laughing. It's one thing to receive an email from Serif telling you an attempt has been made to break into your account; it's entirely another to find that the alleged attempt was more likely a resounding success. (This is the second time I have received a warning about identical hackers.)

I want my user name back! I chose it two years ago; I have a posting history--at one time extensive; I should not lose access to it.

Thank you for any help that can be given. The absurdity of believing any personal or financial information will be harvested here is beyond cray-cray. But I'm still not laughing.

[voitek]

I wouldn't be surprised if the mail was a  scam not sent by Serif and you just sent the hackers your password.

[Hilary]

Dear God. But then why wasn't I able to log onto my account when I accessed the account by typing in the forums.serif.com URL? I did not click on the radio button in the email warning.

[voitek]

Just reset your password through the login page? It sends a reset link to your email.

And change your email account password also.

[Hilary]

I have changed the password associated with the email address at which I received the "warning." I don't know if it's too late.

The originating email address of the warning was "support@seriflabs.com," which, at least according to Verizon, doesn't exist.

BUT I DID NOT CLICK ON THE RADIO BUTTON IN THE EMAIL. I WENT TO THE FORUMS THE OLD-FASHIONED WAY, TYPED IN MY USER-NAME, "AMERICAN," CLICKED ON THE AUTO-FILL (CORRECT) PASSWORD--AND SAW THAT THE ACCOUNT WAS LOCKED. AFTER THREE TRIES, I WAS LOCKED OUT FOR 15 MINUTES. WHAT WAS WORSE, WHEN I CREATED A NEW PASSWORD, MY REAL FIRST NAME WAS GENERATED AS THE FORUM PROFILE NAME. Look, for the past thirteen years, private talk among me and some other Serif users at times addressed our mutual perplexity that Adobe never sued Serif for at least the appearance of appropriating a huge swath of its software. One of my forum friends postulated that Serif might be related to our two governments. What did I care? I know they're into all my stuff anyway, so devil take the hindmost, I figured.

But I did NOT click on any link. And my "American" account WAS locked out. And my first name did NOT appear on the "American" profile. Sweet Jesus, i just would appreciate someone telling me what the heck might be going on.

I CANNOT CHANGE THE PASSWORD TO "AMERICAN" BECAUSE SOMEONE HAS ALTERED IT. I NO LONGER HAVE ACCESS TO THE ACCOUNT.

Thank you.

[voitek]

Then you just have to wait for someone from Serif to help you. I hope you'll get your account back.

[Hilary]

Yes. And I haven't used this forum in many months, nearly a year.

[Alfred]

There are only five posts from the account you're using now: four in the present thread, made in the past hour or so, and one in this thread, made at the beginning of July 2016.

 

The post count for American, who joined at the end of December 2016 (i.e. almost six months after the above July post) currently stands at 74. The last post from that account was made as recently as mid-January of this year.

[dominik]

I may be wrong but perhaps it would help the OP if the problem was posted in the Questions section of the forum?

 

Here at the feature request forum it may slip through the attention of a Serif representative.

 

d.

[Hilary]

15 hours ago, Alfred said:

There are only five posts from the account you're using now: four in the present thread, made in the past hour or so, and one in this thread, made at the beginning of July 2016.

 

The post count for American, who joined at the end of December 2016 (i.e. almost six months after the above July post) currently stands at 74. The last post from that account was made as recently as mid-January of this year.

This time I'm taking a screenshot. I responded to this post yesterday evening, approximately eleven hours ago GMT-5. At length.

The post disappeared.

I asked for your help in reclaiming my "American" account. Please let me know if you can help me.

[Alfred]

14 minutes ago, Tired of Being Hacked said:

I responded to this post yesterday evening, approximately eleven hours ago GMT-5.

 

Eleven hours ago is eleven hours ago, regardless of your time zone!  Anyway, I’m sorry you lost what you typed: I know how frustrating that can be.

 

14 minutes ago, Tired of Being Hacked said:

I asked for your help in reclaiming my "American" account. Please let me know if you can help me.

 

I am not a Serif employee (as evidenced by the lack of a ‘Staff’ badge below my avatar) so I’m afraid I’m not in a position to help.

[carl123]

Bear in mind Good Friday and Easter Monday are both holidays in England.

You may not get a response until Tuesday unless someone at Serf, who can look at your problem, works over the holidays

[Hilary]

18 minutes ago, Alfred said:

Eleven hours ago is eleven hours ago, regardless of your time zone!  Anyway, I’m sorry you lost what you typed: I know how frustrating that can be.

I am not a Serif employee (as evidenced by the lack of a ‘Staff’ badge below my avatar) so I’m afraid I’m not in a position to help.

No; the post was posted. I saw it. Thank you for your concern and for letting me know you are not a Serif employee. In fact, after having posted that last post in response to yours, I noticed that both of the forum accounts you referenced had received similar warning about these Ukraine hackers who apparently have nothing better to do with their time than to hack accounts that no reasonable hacker using any terrestrial language would suspect of containing juicy personal information. This, within 24 hours of my downloading the latest version of Affinity. Never having been accused of being a paranoid schizophrenic, I can't help but ponder the connection between the download and subsequent "hacking attempts." And now I'm really angry.

Thank you for the response, again.

[Hilary]

4 minutes ago, carl123 said:

Bear in mind Good Friday and Easter Monday are both holidays in England.

You may not get a response until Tuesday unless someone at Serf, who can look at your problem, works over the holidays

I am happy to hear that these days are celebrated in England.

Thank you for letting me know.

[walt.farrell]

1 hour ago, Tired of Being Hacked said:

I asked for your help in reclaiming my "American" account. Please let me know if you can help me

(Note that I am also not a Serif employee.)

Based on the information that Alfred posted, about your current account (Tired of Being Hacked) having existed as an account here since July, 2016, vs the American account having been created in Dec., 2016 (and being an active account), it's not obvious to me that you are actually the owner of American. Are you perhaps confused, and is your account one that is similar to American, but slightly different? Or, perhaps, is your account on the older Serif Community forums, for the older Serif products instead?

(Also, looking at the posting style (word usage, grammar, etc.) I remain unconvinced that you and the American who has been posting here are the same person. But it's a small sample size )

Again, I'm not from Serif, and this is all guesswork on my part. No insult or offence intended, either. Just trying to help.

[GDPR-354025]

23 minutes ago, walt.farrell said:

(Note that I am also not a Serif employee.)

 

So noted. I am indeed the owner of two accounts--one, "American," the other, renamed last night to hide my real first name, which had been the name on the older account. I had an older account with Serif during the "Plus" days; I suppose it carried over to the Affinity forums when Serif was transitioning.

As I said in the post before this one, when Alfred replied to me last night (U.S. "last night," March 29), I had not yet realized that BOTH accounts--the old, Serif Plus one, now called "Tired of Being Hacked," plus "American" had been attempted to be hacked, for reasons best known to the "challenged" folk involved therein. The warning that sent me here to the forums had been sent to the email address associated with Serif/Affinity "Plus" account, which I surmised meant my "American" account.

Not realizing that Serif/Affinity had kept both accounts alive, and not having reason to open a second email account associated specifically with the Affinity account, I requested that Affinity send me a "Forgot Password" link.

This is where it gets interesting and frightening. Affinity instantaneously generated a Forgot Password link--to the email address associated with the old Serif/Affinity "Plus" account--not to "American." I clicked on this Reset Password link, and--understandably, I suppose--was unable to generate a new password for "American," because the Reset Password Link was sent to the wrong email address, the address belonging to the old account.

After answering Alfred (which post is gone with the wind), I then and only then decided to check mail in the second email account, a once-a-day habit. THEN I FOUND ANOTHER WARNING THAT UKRAINE HACKERS HAD ATTEMPTED TO ACCESS MY ACCOUNT. This account was the one belonging to "American." (And I have since successfully changed the password--this morning, March 30.)

So much time had passed since I posted under the old Serif/Affinity "Plus" account, I didn't remember it existed. But this was when I started getting very upset indeed, spending a sleepless night. For one account to have been compromised within twenty-four hours of my downloading a new version of Affinity was, in this day and age, no great shakes. For two, not at all associated with each other, by which I mean domain names of webmail accounts, is more than coincidental.

I remain, GMT-5, "American."

Have a good holiday.

[walt.farrell]

Very strange, indeed. But it's good to see that you are, at least, in control of both accounts.

[Alfred]

38 minutes ago, American said:

I am indeed the owner of two accounts--one, "American," the other, renamed last night to hide my real first name, which had been the name on the older account

 

When you say “the older account”, do you mean the one to which you’ve referred a couple of times here as your ‘Serif/Affinity “Plus” account’? Your account on CommunityPlus and/or the old Serif forums is quite separate from the one(s) for these Affinity forums, the latter being solely concerned with the apps in the Affinity suite (i.e. not the ‘legacy’ applications such as PhotoPlus). If I remember correctly, the username under which you posted about the (in)famous ‘massacred’ covered bridge comprised your first initial and your (undisguised) surname.

[GDPR-354025]

Yes, Alfred. It is ten years since the times of the massacred bridge--ten years perhaps to the day. They were very happy times, Serif-wise, very happy. Serif Forums made 2008 a wonderful spring.

 

But if the old forums have no connection to what I have referred to as my "Serif/Affinity "Plus" account, then why would I have two accounts? I never intentionally decided to hide my identity during the 2016 transition to Affinity by coming up with perhaps *the* most generic of all user names; I just came up with it on the spur of the moment and figured "the gang" would know who I was. At most, I might have thought I was changing a user name in my Profile (as I did last night, changing my real name for "Tired of Being Hacked").

 

Actually, ca m'est egal et je m'en fous de tout ca. (I use French not to be more pretentious than I always strive to be, but because one cannot use indelicate language on the Forum.) What I really want to know is why I should get this ominous Ukraine hacker warning--which maybe has nothing to do with poor Ukrainian folk at all!--at two unrelated email addresses. I mean, even though you know my name, Boris, Natasha, Rocky, Bullwinkle, Rock-Bottom, Master Cylinder, and company, presumably do not.

 

The only thing that variations of my name on two different webmail accounts have in common is that I downloaded the Affinity update three days ago, merely to put lipstick, shall we say, on a cow,  a cow who generally is perpetually genial. Now, she has Really Mad Cow disease.

 

I do hope I hear an explanation from someone at Serif on Tuesday. 

[carl123]

They may be very busy on Tuesday as it is the first UK working day after Recaptcha V1 Armageddon

[GDPR-354025]

8 hours ago, carl123 said:

They may be very busy on Tuesday as it is the first UK working day after Recaptcha V1 Armageddon

 

Oh dear Lord, I'm not even sure I want to know what Recaptcha V1 Armageddon is. Is it the code name for Prince Harry's wedding? 

[walt.farrell]

6 minutes ago, American said:

Oh dear Lord, I'm not even sure I want to know what Recaptcha V1 Armageddon is. Is it the code name for Prince Harry's wedding? 

No big deal unless you run a web site; Google it

[GDPR-354025]

At the beginning of the Easter holiday (Thursday or Friday, I'm not sure which), I received an email warning me that potential threats possibly emanating from the Ukraine triggered a warning from Affinity to me. These real--or not--hackers had, according to the email, attempted to access my account sufficiently often so that Affinity urged me to change my password. I had received an email identical to this before, and, because in the previous instance, I was able to access the account with the correct password, I at first paid the warning no heed.

That all changed when I found myself locked out of my account. I panicked, posted on another forum here (where a user suggested I post the question in "Questions"), and immediately changed the password of the email address I believed, mistakenly, as it turned out, associated with the account. When an auto-response from Affinity would not let me change the password, I panicked even more. I had downloaded a new version of Affinity approximately 24--48 hours earlier. I had not done much photo-editing this past winter.

A long-time forum user remarked that I had two accounts. I did not know that I had two accounts. Logging on the following morning to an email account used less frequently than the one at which I got the warning email, to my not inconsiderable, like, terror, I saw another Affinity warning regarding the threat of a compromised account. Subsequent review of that email showed the alleged hackers to be situated very close to where I live, not the Ukraine, as I stated on last week's thread. I did indeed have two accounts, both of which had been rather disturbingly the objects of hackers' attention, for no logical reason. All these Affinity accounts had in common was that the latest version of Affinity had been downloaded to the computer of a user who did not know (s)he had two accounts. The domain names of the webmail are not the same. The name preceding the "at" is not the same. The only thing in common was the fact that I had downloaded a new version of Affinity to my computer.

I am frightened. Users on Good Friday told me to wait until after Tuesday because of some webmaster issues Serif/Affinity may be dealing with. I want to know why I got two fairly identical warnings about accounts being hacked--one (this one) successfully. In real-time as I write this, I don't know if the other, abandoned email account--that I believed was associated with the Legacy software--was hacked.

I just want some assurance. Was this a glitch in affinity.com's software? If not, have other users received warnings about being hacked? While I can't state for a certainty that I have received these warnings more than twice, I most definitely received a similar warning in the past. I am posting this question before being away from my system for at least twenty-four hours; anti-virus and malware scans have come back negative; I can wait. But I *do* need a response. It is jarring at the very least to receive messages so weighty, especially when, realistically, there is nothing that any hacker even on Mars could hope to find out about me from breaking into these accounts.

Thank you. (Screenshots of warnings available on request.)

Edited April 3, 2018 by American
used wrong word

[Alfred]

1 hour ago, American said:

(Screenshots of warnings available on request.)

 

Please provide said screenshots! If you prefer not to attach them here, send me a private message so I can tell you how to share them with me.

[dutchshader]

Strange, the forum account was hacked. But this account has nothing to de with the affinity account where you download the software.