Site Comments & Suggestions

RedFlagDeals has been hacked. Database dump.

  • Last Updated:
  • Apr 17th, 2017 12:27 pm
Deal Guru
User avatar
Feb 8, 2014
12947 posts
2996 upvotes
sillysimms wrote:
Jan 22nd, 2017 1:17 pm
I have no doubt some will take up the offer...I know I'm not the only one contacted, since all email addresses were breached. It was a bcc email.

Glad I use a throwaway email address, but I've used it for a bunch of places so it is annoying to have to change it.

I know legal had to review the notice of the breach before it was sent out...how they reviewed it I don't know. To say no personal info was taken and to fail to mention email addresses were part of the breach isn't proper notification.
Indeed, every user should have a popup. Notice how PMs are also missed since no more popup, i have ones i sent 4 months ago the recipient never received.
I also used a disposable address, a few months back before this broke i was thinking of replacing with regular e-mail but never bothered to do it, glad i didn't
Lies, damned lies, statistics and alternative facts
Moderator
Sep 27, 2003
8076 posts
1487 upvotes
Newmarket
Hellfire wrote:
Jan 22nd, 2017 1:29 pm
*sigh* my account was accessed again. This time they didn't change my email addy so I was able to reset and change password but still....@TomRFD
So they are still sending PMs and creating posts from within your login? @TomRFD should have force closed all active sessions for your user name (which would have logged out the hackers) and then once you changed your password, would have prevented them from logging back in. There is no other way they are getting in unless their session was still logged in or are somehow getting your new password through other means. @TomRFD should be able to validate how they are accessing your account, if they got the password right on first attempt, and hopefully from where the account is being accessed.
RFD Forums Moderator
Corporate Account Manager for a Bell Mobility Reseller
Deal Fanatic
User avatar
Sep 7, 2003
7372 posts
271 upvotes
Edmonton
WorldIRC wrote:
Jan 22nd, 2017 2:52 pm
So they are still sending PMs and creating posts from within your login? @TomRFD should have force closed all active sessions for your user name (which would have logged out the hackers) and then once you changed your password, would have prevented them from logging back in. There is no other way they are getting in unless their session was still logged in or are somehow getting your new password through other means. @TomRFD should be able to validate how they are accessing your account, if they got the password right on first attempt, and hopefully from where the account is being accessed.
Yes, I'd appreciate him sharing details of what he discovers so I can take appropriate measures. @TomRFD
Deal Fanatic
Oct 6, 2007
5084 posts
1279 upvotes
Kootenays
I guess this is why I'm getting such an increase in spam emails to the account that is registered here. Bummer!
Deal Addict
Aug 29, 2012
3718 posts
864 upvotes
This is why I use a unique 16 random characters password for every single website. Just try to brute force it.
As we all know, the Greater Toronto Area is the center of the universe!
Deal Addict
User avatar
Apr 29, 2005
3807 posts
5 upvotes
Markham Toronto area
I just noticed I'm no longer getting email notification of PM's after my account was restored. I verified that my email address is still the same and not in spam folder.

Edit : Nevermind, realized I need to enable it manually after the hackers disabled it.
Deal Fanatic
User avatar
May 12, 2004
8937 posts
3039 upvotes
Ottawa
sillysimms wrote:
Jan 22nd, 2017 12:33 pm
So now I'm getting emails (directly, not RFD PMs) as a result of this breach. They say they know I'm a long term member on this site and they are willing to pay me or offer free products to post favourable reviews for them. To contact them for details.

Regarding the initial notification of the breach, I still don't know why they failed to advise email addresses were also obtained.
Me too and some of these companies are very surprising and their offers very appealing. I have a feeling they ran a check on member seniority/post count and are targeting these people to fly under the radar.

I agree we should have been told the extent of this breach...sounds like they found their legal department in group deals.
Censorship is telling a man he can't have a steak just because a baby can't chew it.
- Mark Twain
Deal Guru
User avatar
Nov 28, 2013
12242 posts
3896 upvotes
Oakville
Cas77 wrote:
Jan 23rd, 2017 9:06 am
Me too and some of these companies are very surprising and their offers very appealing. I have a feeling they ran a check on member seniority/post count and are targeting these people to fly under the radar.
The thing is - shill posts are usually pretty easy to spot. The Amazon Marketplace deals in particular are super obvious. Though I'm curious which companies offered you deals that were surprising, or appealing? Any of the ones I was ever offered were pretty weak.
Public Mobile
Deal Addict
User avatar
Aug 30, 2003
3181 posts
88 upvotes
After reseting my password and logging in (with the temp password sent over insecure email) I was not forced to immediately change my password. Very poor password reset flow RFD, especially after a hack. BTW this was on the mobile site. If RFD needs some info Sec help send me a PM, I work in security. Grinning Face
Last edited by rilhouse on Jan 23rd, 2017 9:36 pm, edited 1 time in total.
Deal Fanatic
User avatar
Jan 11, 2008
7207 posts
737 upvotes
GTA
I've never been logged out or asked to change my password. I'm guessing that is because I had previously changed my password since this happened.
When your mind says give up, hope whispers "one more try"
Never say never
Newbie
Nov 12, 2011
1 posts
Toronto
For some reason today I was asked to change my password so I reset my password. Then when I use the new password it didn't work either I contacted support and they told me I had to login using Facebook which my account was not set ever set up that way. So I went into this account after logging into Facebook and I have none of my information is accessible
Administrator
User avatar
Jun 17, 2013
8213 posts
12624 upvotes
Scarborough
rilhouse wrote:
Jan 23rd, 2017 9:36 pm
After reseting my password and logging in (with the temp password sent over insecure email) I was not forced to immediately change my password. Very poor password reset flow RFD, especially after a hack. BTW this was on the mobile site. If RFD needs some info Sec help send me a PM, I work in security. Grinning Face
We're working on fixing the redirection after coming in from resetting your password.
sillysimms wrote:
Jan 23rd, 2017 10:57 pm
I've never been logged out or asked to change my password. I'm guessing that is because I had previously changed my password since this happened.
That is exactly why you were not forced to reset your password.
kyfe101 wrote:
Jan 25th, 2017 4:37 pm
For some reason today I was asked to change my password so I reset my password. Then when I use the new password it didn't work either I contacted support and they told me I had to login using Facebook which my account was not set ever set up that way. So I went into this account after logging into Facebook and I have none of my information is accessible
The account you identified was kyfe101. I sent you instructions on how to gain access to your other account.
RFD Staff [Forum Rules] [Facebook] [Twitter].
Deal Fanatic
User avatar
Jan 11, 2008
7207 posts
737 upvotes
GTA
chaosfang wrote:
Jan 26th, 2017 2:15 pm
Did anyone get an email from uypoj@makotek.net with an invoice?? They had my RFD login info in the email itself...

I didn't get that one, but have gotten several that are directly as a result of this hack.

Unfortunately no one has addressed why the email notice that was sent to us about the breach failed to contain all the appropriate information. These type of things seem to happen to a lot of sites, but notification should include all relevant information and this one did not.

Hopefully you didn't open the invoice if it was an attachment.
When your mind says give up, hope whispers "one more try"
Never say never

Top