First of the ncix leaked info scam letters going out?

[leaderdog]

I guess with the WAN show bringing attention to the fact that NCIX's info has been sold to unscrupulous individuals, the "hackers" are now trying to extort money.

 

I received this email this morning:

 

From: shows my email (the one on ncix)
Sent: September 25, 2018 2:40 PM
To: *shows password you used on ncix*
Subject: account was hacked

Hello!
I'm a member of an international hacker group.

As you could probably have guessed, your account *email that was on ncix* was hacked, I sent message you from it.

Now I have access to you accounts! You still do not believe it? 
So, this is your password: *******(correct password for ncix) , right? 

Within a period from July 5, 2018 to September 21, 2018, you were infected by the virus we've created, through an adult website you've visited.
So far, we have access to your messages, social media accounts, and messengers.
Moreover, we've gotten full damps of these data.

We are aware of your little and big secrets...yeah, you do have them. We saw and recorded your doings on porn websites. Your tastes are so weird, you know..

But the key thing is that sometimes we recorded you with your webcam, syncing the recordings with what you watched!
I think you are not interested show this video to your friends, relatives, and your intimate one...

Transfer $700 to our Bitcoin wallet: 1DzM9y4fRgWqpZZCsvf5Rx4Hu********
I guarantee that after that, we'll erase all your "data" :D

A timer will start once you read this message. You have 48 hours to pay the above-mentioned amount.

Your data will be erased once the money are transferred.
If they are not, all your messages and videos recorded will be automatically sent to all your contacts found on your devices at the moment of infection.

You should always think about your security. We hope this case will teach you to keep secrets.
Take care of yourself.

Scare letter essentially.  So delete if you get it.  Clearly the fools that bought the info from ncix.

 

And of course, change your passwords if you use the same for other sites as Luke said on the WAN show.

 

Edited September 25, 2018 by colonel_mortis
Redact bitcoin address, just in case

[Levent]

lol someone actually spent some time for this spam email, I was getting tired of african bankers.

[MCBYT]

This is a meme

"Your tastes are so weird, you know..."

"A timer will start once you read this message" 

[epikgamerwmp]

6 minutes ago, leaderdog said:

I guess with the WAN show bringing attention to the fact that NCIX's info has been sold to unscrupulous individuals, the "hackers" are now trying to extort money.

 

I received this email this morning:

 

From: shows my email (the one on ncix)
Sent: September 25, 2018 2:40 PM
To: *shows password you used on ncix*
Subject: account was hacked

Hello!
I'm a member of an international hacker group.

As you could probably have guessed, your account *email that was on ncix* was hacked, I sent message you from it.

Now I have access to you accounts! You still do not believe it? 
So, this is your password: *******(correct password for ncix) , right? 

Within a period from July 5, 2018 to September 21, 2018, you were infected by the virus we've created, through an adult website you've visited.
So far, we have access to your messages, social media accounts, and messengers.
Moreover, we've gotten full damps of these data.

We are aware of your little and big secrets...yeah, you do have them. We saw and recorded your doings on porn websites. Your tastes are so weird, you know..

But the key thing is that sometimes we recorded you with your webcam, syncing the recordings with what you watched!
I think you are not interested show this video to your friends, relatives, and your intimate one...

Transfer $700 to our Bitcoin wallet: 1DzM9y4fRgWqpZZCsvf5Rx4HupbE5Q5r4y
I guarantee that after that, we'll erase all your "data" :D

A timer will start once you read this message. You have 48 hours to pay the above-mentioned amount.

Your data will be erased once the money are transferred.
If they are not, all your messages and videos recorded will be automatically sent to all your contacts found on your devices at the moment of infection.

You should always think about your security. We hope this case will teach you to keep secrets.
Take care of yourself.

Scare letter essentially.  So delete if you get it.  Clearly the fools that bought the info from ncix.

 

And of course, change your passwords if you use the same for other sites as Luke said on the WAN show.

 

Do you even have a webcam?

[a99007]

dude you gotta prank him (PS don't if the info he has is "critical" )

[Velcade]

"We are aware of your little and big secrets...yeah, you do have them"

 

classic.

[Rewritten]

So sad that they are doing this.

[Plstudio]

Received the same on today. The 2 differences are that

 

1. Yesterday my email was actually hacked and 300+ emails were

sent from my account

(no malware detected)

 

2. The “from” email I received was my own email address

 

advice? 

 

Hello!
I'm a member of an international hacker group.

As you could probably have guessed, your account dom@plumbline.com was hacked, I sent message you from it.

Now I have access to you accounts! You still do not believe it? 
So, this is your password: xxxxxx, right? 

Within a period from July 5, 2018 to September 21, 2018, you were infected by the virus we've created, through an adult website you've visited.
So far, we have access to your messages, social media accounts, and messengers.
Moreover, we've gotten full damps of these data.

We are aware of your little and big secrets...yeah, you do have them. We saw and recorded your doings on porn websites. Your tastes are so weird, you know..

But the key thing is that sometimes we recorded you with your webcam, syncing the recordings with what you watched!
I think you are not interested show this video to your friends, relatives, and your intimate one...

Transfer $700 to our Bitcoin wallet: 1DzM9y4fRgWqpZZCsvf5Rx4Hup********
I guarantee that after that, we'll erase all your "data"

A timer will start once you read this message. You have 48 hours to pay the above-mentioned amount.

Your data will be erased once the money are transferred.
If they are not, all your messages and videos recorded will be automatically sent to all your contacts found on your devices at the moment of infection.

You should always think about your security. We hope this case will teach you to keep secrets.
Take care of yourself.

 

 

Edited September 25, 2018 by colonel_mortis
Redact bitcoin address, just in case

[epikgamerwmp]

Just now, Plstudio said:

Received the same on today. The 2 differences are that

 

1. Yesterday my email was actually hacked and 300+ emails were

sent from my account

(no malware detected)

 

2. The “from” email I received was my own email address

 

advice? 

 

Change your password right now.

[Plstudio]

I changed the email passwords immediately after the initial breach 

 

the password they have or had is not one that is used for my email thankfully looks like the email / password combo was sourced from adobe cloud or Dropbox or some other online service.

 

still though. Spending the day updating...

[Little Computer]

11 minutes ago, Plstudio said:

Received the same on today. The 2 differences are that

 

1. Yesterday my email was actually hacked and 300+ emails were

sent from my account

(no malware detected)

 

2. The “from” email I received was my own email address

 

advice? 

 

Hello!
I'm a member of an international hacker group.

As you could probably have guessed, your account dom@plumbline.com was hacked, I sent message you from it.

Now I have access to you accounts! You still do not believe it? 
So, this is your password: xxxxxx, right? 

Within a period from July 5, 2018 to September 21, 2018, you were infected by the virus we've created, through an adult website you've visited.
So far, we have access to your messages, social media accounts, and messengers.
Moreover, we've gotten full damps of these data.

We are aware of your little and big secrets...yeah, you do have them. We saw and recorded your doings on porn websites. Your tastes are so weird, you know..

But the key thing is that sometimes we recorded you with your webcam, syncing the recordings with what you watched!
I think you are not interested show this video to your friends, relatives, and your intimate one...

Transfer $700 to our Bitcoin wallet: 1DzM9y4fRgWqpZZCsvf5Rx4HupbE5Q5r4y
I guarantee that after that, we'll erase all your "data"

A timer will start once you read this message. You have 48 hours to pay the above-mentioned amount.

Your data will be erased once the money are transferred.
If they are not, all your messages and videos recorded will be automatically sent to all your contacts found on your devices at the moment of infection.

You should always think about your security. We hope this case will teach you to keep secrets.
Take care of yourself.

 

 

 

43 minutes ago, leaderdog said:

I guess with the WAN show bringing attention to the fact that NCIX's info has been sold to unscrupulous individuals, the "hackers" are now trying to extort money.

 

I received this email this morning:

 

From: shows my email (the one on ncix)
Sent: September 25, 2018 2:40 PM
To: *shows password you used on ncix*
Subject: account was hacked

Hello!
I'm a member of an international hacker group.

As you could probably have guessed, your account *email that was on ncix* was hacked, I sent message you from it.

Now I have access to you accounts! You still do not believe it? 
So, this is your password: *******(correct password for ncix) , right? 

Within a period from July 5, 2018 to September 21, 2018, you were infected by the virus we've created, through an adult website you've visited.
So far, we have access to your messages, social media accounts, and messengers.
Moreover, we've gotten full damps of these data.

We are aware of your little and big secrets...yeah, you do have them. We saw and recorded your doings on porn websites. Your tastes are so weird, you know..

But the key thing is that sometimes we recorded you with your webcam, syncing the recordings with what you watched!
I think you are not interested show this video to your friends, relatives, and your intimate one...

Transfer $700 to our Bitcoin wallet: 1DzM9y4fRgWqpZZCsvf5Rx4HupbE5Q5r4y
I guarantee that after that, we'll erase all your "data" :D

A timer will start once you read this message. You have 48 hours to pay the above-mentioned amount.

Your data will be erased once the money are transferred.
If they are not, all your messages and videos recorded will be automatically sent to all your contacts found on your devices at the moment of infection.

You should always think about your security. We hope this case will teach you to keep secrets.
Take care of yourself.

Scare letter essentially.  So delete if you get it.  Clearly the fools that bought the info from ncix.

 

And of course, change your passwords if you use the same for other sites as Luke said on the WAN show.

 

I received that exact same email today, actually I receive two with different passwords on it but I have never bought anything fromI received that exact same email today, actually I receive two with different passwords on it but I have never bought anything from NICX  or had anything to do with him as far as I’m aware!

[leaderdog]

45 minutes ago, epikgamerwmp said:

Do you even have a webcam?

I do not have a webcam.

 

I knew this was fake.  I did a malwarebytes scan anyways out of curiosity, but of course it found nothing.  I only had one other place that I used the same password and I had changed that yesterday.

 

I figured most people here are smart enough to know it's nonsense, but posted it for the few that may have gotten spooked.

[AdroG23]

The problem with this generic kind of scam is that they are so vague that they're funny.

I got something similar in my work mail stating pretty much the same with minor changes...
And they also had my recordings watching porn and stuff!!!!
Except i have no webcam on my pc...
Come on guys, i know you can try a little harder than that!

[leaderdog]

14 minutes ago, AdroG23 said:

The problem with this generic kind of scam is that they are so vague that they're funny.

I got something similar in my work mail stating pretty much the same with minor changes...
And they also had my recordings watching porn and stuff!!!!
Except i have no webcam on my pc...
Come on guys, i know you can try a little harder than that!

The reason I made mention of if, is because it had my correct password and email that I used for ncix.com.  Pretty slim chance they were going to guess what my password was, so I figured it had to do with the ncix sale of the private info sitting on the harddrives.

 

Which means there is a legitimate issue, if you used the same password for other accounts.   It's just a matter of testing out a few sites like amazon, newegg or memoryexpress etc.

 

While the email may be generic, the password threat could be a problem.

[AdroG23]

2 minutes ago, leaderdog said:

The reason I made mention of if, is because it had my correct password and email that I used for ncix.com.  Pretty slim chance they were going to guess what my password was, so I figured it had to do with the ncix sale of the private info sitting on the harddrives.

 

Which means there is a legitimate issue, if you used the same password for other accounts.   It's just a matter of testing out a few sites like amazon, newegg or memoryexpress etc.

 

While the email may be generic, the password threat could be a problem.

No, i know.

I didn't mean that in your case it wasn't a serious problem. Sorry if it got understood as that.

And obviously, changing every password is the logic, safe way to go!

Just wanted to comment on how some less inventive scammers got a hold of the idea and tried to "replicate" it without much of a thought

[Speed Weed]

Nigerian Prince. 

[SimplyChunk]

I'd just let them watch me watching porn.  It can't be a very pretty sight

Edited September 26, 2018 by YouSirAreADudeSir
spelling

[BuckGup]

Report the bitcoin address to the authorities. If they aren't cleaning their bitcoins you can technically track them

[2FA]

These types of emails have been on the rise for the past several months. All they do is search through data breach dumps and send spam emails which include the password that was in the data breach (though if you use that password on other sites, they'll probably try to break in). I don't believe I ever created a NCIX account so there wasn't a password to be disclosed but I'm expecting I'll probably receive more spam here in the next few weeks.

[RemingtonXR]

I got the same email and I use different password for different sites.  The password they revealed was from USAJobs site.  Monsters and USAJobs had their data breached in 2009.  https://news.clearancejobs.com/2009/01/26/monster-com-and-usajobs-data-breach/

[Big Reg]

Just received the exact same email. I found this forum thread about it via Google (the only search result so far).

 

The password they said was mine wasn't the one I use for the email address I received the email by, but it was a password I'd used elsewhere some years ago for something else - possibly Yahoo email.

 

Question is though, if the password they said was my email password was incorrect, how did they manage to send me an email from my email address? I checked the full headers, and sure enough the sender was the server used by my email host. I'm aware of spoofing email 'From' headers, but the email message certainly looks legitimate to be the host my email is on.

[Rewritten]

Just now, Big Reg said:

Just received the exact same email. I found this forum thread about it via Google (the only search result so far).

 

The password they said was mine wasn't the one I use for the email address I received the email by, but it was a password I'd used elsewhere some years ago for something else - possibly Yahoo email.

 

Question is though, if the password they said was my email password was incorrect, how did they manage to send me an email from my email address? I checked the full headers, and sure enough the sender was the server used by my email host. I'm aware of spoofing email 'From' headers, but the email message certainly looks legitimate to be the host my email is on.

It's like you said: spoofing. If you are sure that they didn't get access into your e-mail account, then it has to be spoofing. It's been getting more sophisticated as of late.

[Big Reg]

Seems they're getting passwords from all sorts of sources. I'm wondering now if they've cross-referenced multiple databases for name and address matches, and hope the passwords discovered are the same ones used over and over by their target victim. Recognising a familiar password in a scam email does certainly get your undivided attention.

[mdchachi]

I also received this exact same message today, hence the reason I am here.  Since I use a unique email address for every web site I access, I know with certainty that in my case the hack is originating from livejournal.com one way or another.  Is there anything I can do?  I mean, if this is a live, open security hole that isn't plugged I'd like to raise the issue somehow.

On the other hand I do see online references to livejournal hacks from over 10 years ago.  So maybe it's coming from then.

 

To the earlier poster, if you look carefully at your full headers you should see where the mail is coming from.  In my case it's:

==>     Received: from r201-217-143-170.ir-static.anteldata.net.uy ([201.217.143.170])

which maps to Montevideo, Uruguay

[Texconsin]

Got one of these, too.  The password was NOT that used on my email account and a check of the headers showed it was NOT coming from my email account.  It's time we bomb Macedonia!  The worst thing that ever happened was the fall of the Iron Curtain!

IP General Information

IP Address:

77.29.65.161

Hostname:

77.29.65.161

ISP:

Makedonski Telekom AD-Skopje

IP Geolocation Information

Continent:

Europe (EU)

Country:

Macedonia (MK) 

City:

Skopje

Time Zone:

Europe/Skopje

Latitude:

42 (42°0'0" N)

Longitude:

21.4333 (21°25'59.88" N)