pelago

Glad to finally hear some kind of confirmation of a compromse on that other (locked) thread. I think the reason that not many people have reported spam as a result of that attack is because most people don't use site-specific email addresses, and the spam being sent is conspiracy gun-nut stuff, not about basses, so if they received the spam most people wouldn't know that it was anything to do with basschat. Also, it's quite possible that they only took some of the database, and that some people's ISPs are better at filtering spam than others. But the fact that more than one person with a site-specific email address for basschat reported the spam means that it's most likely it came from a basschat-compromised database, even if others didn't get it. For interest, I changed the email address registered on the basschat site on 2 Jan, and that new email address hasn't received spam yet. The old email address has still received some, e.g. the Diana one the other day. The fact that the new address hasn't received spam is a good sign, as it probably means that the database hasn't been compromised since 2 Jan.

I (the OP) have also received the second email to my basschat-specific email address. Since then, I have just changed the email address I have registered with basschat to a new one - I'll see if that one gets spammed too.

Oh, is that true? I didn't think that was normal for forums. Are you sure it's not just because you're a moderator that you can see my email address? Can anyone else (non-moderator) confirm that they can see my email address?

Thanks for the replies. I've never typed the email address I use for this forum into anywhere else. The only places it would appear would be in this forum's database, and briefly in my email inbox when I got the confirmation email from you. That email was deleted quickly. I doubt my workstation was hacked (I run Linux and I work in IT so hopefully know what I'm doing). If it wasn't your registration database itself that was compromised, you might want to look into seeing for any log files containing email addresses, or whether your email outgoing path is secure - e.g., can you trust your ISP not to be harvesting email addresses when you send out confirmation emails. Edit: I've just realised that the other place the email address exists is at my email hosting company of course. I'm pretty sure they haven't been hacked (they are a small company and very open about things), and anyway, I have hundreds of email addresses registered with them but only received spam sent to my basschat-specific email address. Anyone else who [i]has[/i] received the spam, it would be useful to know if the email address it was sent to was unique for basschat. If you only have one email address that you use for lots of things, then there's no reason to blame basschat. Anyway, I'm not trying to make any trouble, just passing on the info. The very reason I setup unique addresses like this is to try and help notify people of possible problems.

Hi, Last night I received a piece of junk email at an email address that I've only ever used for basschat. (I create a new email address for each new website I register on, so that if an address gets compromised, I know who to blame and so that I can delete/change that individual address without affecting any others). The subject line was "Newtown, Connecticut is the second Dunblane Primary-School Massacre." As this email address has only ever been typed into one place, the basschat registration form, that must mean that your user database has been compromised, assuming that you aren't selling or giving away our email addresses knowingly. I don't use the site much but I see some messages about a hack, although I haven't read that the user database had been compromised. It would be nice to have a definitive thread explaining exactly what had happened. Anyway, I thought you might like to know.

I bought Jay's Vox amPlug. It was very quickly posted and everything went very well. Thanks.