I received two e-mails in recent days from online training provider Lynda.com customer care, this is because I have had two accounts with Lynda.com in the past. Both were set-up when they had a 30 day free trial offer, which I made use of.

I’m one of the 9.5 million customers/former customers of Lynda.com who have been contacted by them about a breach of their data security. They state that my contact information and courses taken were compromised, however they believe my password was not compromised. Here is the text of the e-mail:

So this doesn’t sound so bad. Right?

Nope. They have my contact information, so they have my name, e-mail address and mobile phone number. That means I could be targeted for phishing or even worse spear phishing. I tried to see if I could delete my Lynda.com account, but nothing obvious jumped out at me. I must check their online help and if there is nothing there, I will be contacting their “customer care” to try to get rid of these accounts.

There were 55,000 people who have been contacted by Lynda.com customer care telling them that their passwords have been compromised and so Lynda.com have forced a reset of their password.

I actually don’t care about my password, the hackers would be welcome to it, as that is unique to my Lynda.com account, I would not have used it anywhere else. However, to use their terms, out of an abundance of caution I have changed my passwords on the two accounts I have, to some complete gibberish that even I won’t remember. I’ve stored them in my password manager.

So what lessons can be learnt here:

Everyone has heard about the personal information related to 500 million Yahoo accounts being stolen from Yahoo in 2014. There’s lots of helpful tips out there (and some here too), but some people may not realise that they have a Yahoo account.

Yahoo provides e-mail services to some big internet service providers (ISPs), over in the US AT&T, Rogers and Frontier.com. Over on this side of the Atlantic Sky and BT are large ISPs operating in Ireland and the UK. Their e-mail services are powered by Yahoo.

There are reports that Sky and BT are contacting their customers, so that at least should hopefully highlight to those people that, yes, you do have a Yahoo account too, it’s just by a different name.

A large amount of the Yahoo accounts will no doubt be dormant and no longer in use by their owners. I certainly had a Yahoo account quite some time ago, but I never associated it with myself (shock/horror – I lied on the Internet ?) or with any other account. The bad guys are welcome to it, as I know it can’t connect to me.

However if you used the same user name on a Yahoo account (dormant or not) on some other accounts (GMail, Facebook, LinkedIn, Microsoft, etc.) then the Yahoo account details could be tried by the evil doers against these other services.

Of course, you will have used the same password on them all, so that’ll make their life so much easier to ruin yours. ?

So the first tip is to change your Yahoo account password now. You should also change this password on all of the other online accounts that you use it on. However this time you might take the sensible decision and give every account a unique password. You can learn how to do this easily at the Internet Safety Training which L2 Cyber Security Solutions deliver. However if you struggle to come up with the means to do this, then you should invest in a Password Manager. This can do the hard work for you.

On any on-line service that you use, if it has a means to implement, what is called, Two Factor Authentication, then turn it on NOW! I cannot stress how much this improves your security position just by turning this feature on.

I go into in more detail here, but briefly, if you are using Facebook or Dropbox (to name but two, there are dozens that subscribe to this method) you can download the Google Authenticator App onto your smart phone (available on Android and Apple). Then inside in the account security settings of your on-line service, activate the Two Factor Authentication, telling it you use Google Authenticator. It will put up a QR code on screen, which you show to the App and it will then start generating a 6 digit code that changes every 30 seconds.

So now what happens is that if you (or some evil doer) tries to sign on to your account from a different device or location, even if they have your password they will also now need the 6 digit code that is showing up on your Google Authenticator App. Without it, they get nowhere.

If the on-line service does not support Google Authenticator, then they might send you a text message instead. This is not quite as secure as the App, but it is better than nothing.

It wasn’t just user name and passwords that were stolen, but details like date-of-birth, mobile phone number and answers to security questions.

Details like date-of-birth and mobile number are kinda hard to change, but the security questions are another concern. If you have some other on-line accounts that use the same security questions, now would be a good time to go and change these.

A much simpler solution would be to implement Two Factor Authentication, as outlined above.

The internet is a wonderful but dangerous place and there are a lot of bad guys who are making a lot of money from your accounts. So …

This is where you can set your on-line accounts to not only request your user ID and password (something you know) but also using your phone (something you have) by way of an app or sending you a text message with a code that you enter on the site to confirm you are you. 

If you have this set-up to authenticate by a SMS Text message, then a bad guy who has access to your LinkedIn details from the 2012 hack should not be able to access your e-mail account using the password that they have recovered from there, because as soon as they try to access your e-mail account, you will be sent a text message. So you’re safe … right?

 The three tips on that video at the end are very pertinent:

So really, the best way to secure your account is to use an app on your smart phone like Google Authenticator, Authy or Duo. These are constantly generating random 6 digit codes which you can use to authorise your access to an account. These will work even in flight mode. So if you receive a text message asking for your code, you can simply ignore it. Here’s an example from Google Authenticator:

The training that L2 Cyber Security Solutions delivers, will give you a better understanding of the threats that are out there and show you how you can easily protect yourself from them. 

Well in this case I am popular … for the scammers. Each one was a fake profile.

Firstly none of them had a connection in common with any of my contacts. This always makes me question why are they trying to connect with me.

I then Googled the names and companies.

The first was “Adline matter”, apparently a doctor from the photo. Google reckoned I wanted Adelaide Matter. Ignore & Report as Spam!

The next was “James Freeman, of Sailer Benefit”. Google reckoned this was a Texan who had been executed for murder earlier this year. Deeper searching on the Sailer Benefit side showed no connection with a James Freeman. Ignore & Report as Spam!

The third was a “William Parker, of Barclays”. Lots of hits here, all indicating it was a scammer. Ignore & Report as Spam!

The next one was a real person! It was “Ayesha Gadaffi, of AYG Group”, the daughter of a certain Libyan Dictator. When the company name was included in the Google search, this highlighted it as a scam account. Ignore & Report as Spam!

The fifth was again a real person. Goes by the name “Asare Akuffo, of Bank Atlantec”. It shows that he is a banker, but there was no association with Bank Atlantec. Ignore & Report as Spam!

Finally, “Hesham Abdulla Al Qassim, Vice Chariman of the Board” is also a real person, but his Real LinkedIn (which was the first search result) shows him as CEO. Ignore & Report as Spam!

So folks, you should be wary of any connection request for people you do not know. It’s the same rule we should apply to receiving e-mails from strangers. Don’t accept connection requests from strangers, even if they have a common connection. If you are tempted, just spend a few extra seconds and Google them and their company or position and see what shows up.

Lets be careful out there.