Recent Spate of Compromised Google Accounts

Recently, Network Services has been notified of a number of MLC Google Accounts being compromised, most often by the account information being found on publicly-available credential lists from past compromised sites. In most cases this has not meant that Google or MLC has been compromised, but that one of two things has happened:

• A person has freely given over their account credentials after being scammed via a phishing email.
• Another website has been compromised and the credentials gained from there were the same as what is used for an MLC Google Account.

In both cases, the same thing occurs:

1. Google suspends the affected MLC Google Account.
2. MLC Network Services is notified of the possible compromised.
3. MLC Network Services staff change the password on the account and then restore the account.
4. If a person has a personal email address listed on Portal, they are sent a password reset email and a message warning that the change has been done.

If the person does not have a personal email addresses listed on Portal, they are not notified and will not be able to log into their account until they contact Network Services and requests a password reset after verifying their identity in some way.

If your account was compromised and you have access again, then you need to do two more things:

• Check for filters and forwarding rules so that email is not being forwarded to suspect addresses.
• Check to make sure their signature has not been changed.
• Check under Accounts for settings changed for how you are sending email. You will want to check what your reply-to address is set as too.

The recently compromised accounts have had a problem where incoming emails are automatically sent to Trash. Removing that filter above will fix that issue specifically.

Google has also provided a page with information on how to keep your MLC Google Account more secure. You can take a look at that page and follow any steps on it to secure your MLC Google Account beyond just a simple username and password.