Being hacked

I was hacked! I suppose I shouldn’t be surprised, but I’m usually quite careful and it’s the first time it’s happened to me. The hacker(s) seemed mostly to be interested in websites that might give them access to money in some shape or form. An understandable motive. You don’t want to be hacked, it’s taken several days of hard effort to drag myself clear, and although the activity has dropped to a very low level now, it might still be too soon to feel completely safe.

Here’s what happened as far as I can tell.

I was browsing around on Patreon, noting the range of people running businesses, charitable sites, enthusiast groups, news and comment on specialist topics and so forth.

I spotted one site offering advice on the digital currency market, an idea that has always intrigued me. And somehow I managed to click through to links to sign up – mistakenly imagining they were just for more information. I soon got a charge on my PayPal account, quite a large charge that I couldn’t at first identify except that it came from Patreon. When I understood that to be the case I went into my Patreon account and discovered (to my horror) that I was now a member of the advice site I thought I’d been browsing.

It didn’t take long to unsubscribe myself, and apart from a second, much smaller, Patreon payment through PayPal, that seemed to be the end of the matter. But then further payments appeared, but each one was rolled back by Patreon to my PayPal account, presumably because I was no longer a member of the account and there was some lag in the process.

After that (and I don’t know whether there’s a connection between what had already happened and what happened next) I began to receive password change announcements from a range of sites I use. PayPal was the first so I contacted them and they refunded a payment I’d queried because they judged it to be fraudulent. But the flurry of ‘your password has been changed’ announcements grew and grew, and was then joined by texts and emails telling me I could gain access to my account again using this or that six-digit key.

At that point I became very suspicious. Why were these access key messages coming to me? Someone had put false passwords into some of my sites and then used the ‘I forgot my password option’. But they hadn’t been able to login. They knew my email address (often the username) and so did the website, so the access key came to me. But if I was to enter one of them, the site would let the hacker in – not me. This happened with PayPal, Patreon, Buy Me A Coffee, Microsoft, Etsy and several more.

I’ve had a bit of a fright, lost some money (not catastrophically, but annoyingly) and have had to spend a lot of time getting everything straightened out. The flow of emails and texts has diminished now, just one or two this evening. If I have a week or two without any sign of activity I shall heave a big sigh of relief.

I’ve been through all the passwords in my password manager, removing sites that I never use or are no longer available, changing all reused passwords, and making sure all that remain are strong (long, random, containing both upper and lower case, numerals, and special characters). The password manager generates and stores these for me and can log me in automatically on most sites.

I’m looking forward to relaxing again in time, but for the moment I’m still being vigilant.

See also:

• The Best Password Managers for 2025 – PC Mag

Useful? Interesting?

If you enjoyed this or found it useful, please like, comment, and share below. My material is free to reuse (see conditions), but a coffee is always welcome!