Eurostar online account "security upgrade"?

[HantsExile]

I've received an email purporting to come from Eurostar, saying that they are upgrading the security of their website and asking me to reset my password.

Not wishing to be paranoid, but I'm aware of many online scams which start with password-related requests.

I've hovered my mouse above their email address and it looks OK. But ...

Has anyone else received this email and does anyone else feel at all uneasy about it?

 

[Bletchleyite]

I saw that and have made the assumption that they have experienced a data breach. Whenever you get this sort of email that is normally why.

Could well be how my debit card got "done" earlier in the year. Fortunately I don't use standard passwords (I generate each organisation a separate one in Keepass) so only theirs will have been breached.

The more innocent possibility is that they've changed their authentication mechanism and couldn't migrate the passwords, but in my experience a news article of a data breach has a habit of appearing a week or two after these emails are sent.

With any email like this, to avoid being a victim of a scam never click a link in it, instead independently go to the company's website and reset your password. Same as with your bank - if you're called and asked to divulge information, politely end the call (on a landline, ensure it has actually ended, that's a known scam in itself as with landlines the call stays open until the caller ends it) and call the number printed on your card.

 

[185]

I didn't get one. Probably phishing. Message them via twitter or their website.

There was a data breach, but in 2018, not now (that I know of).

Edit: ignore this, it sounds genuine

 

[nlogax]

It's actually Eurostar, hundreds of users are reporting the same issue this morning.

https://www.bleepingcomputer.com/ne...ssword-resets-then-fails-and-locks-users-out/

International high-speed rail operator, Eurostar, is emailing its users this week and forcing them to reset their account passwords in a bid to "upgrade" security.

But users who visit the password reset link are met with "technical problems," thereby making it impossible for them to reset their password or log in to their accounts.

 

[Bletchleyite]

I didn't get one. Probably phishing. Message them via twitter or their website.

There was a data breach, but in 2018, not now (that I know of).

Definitely not phishing. You probably did get one but it's been picked up as spam.

 

[ainsworth74]

I've not had an email but I tried to login into their app over the weekend and got asked to change the password then.

 

[HantsExile]

It's actually Eurostar, hundreds of users are reporting the same issue this morning.

https://www.bleepingcomputer.com/ne...ssword-resets-then-fails-and-locks-users-out/

Thanks for this and other helpful replies.

I don't need to log into Eurostar right now so will keep an eye on developments.

 

[duncanp]

I had the same issue, and "changed" my Eurostar password to, er, the same as it was under the old system.

 

[AlterEgo]

Also had the same email, which went into my spam.

 

[Bletchleyite]

I had the same issue, and "changed" my Eurostar password to, er, the same as it was under the old system.

I would actually change it (and anything else using the same one) in case it has been breached, as there's a good chance it has.

 

[popeter45]

yesterday i had to log onto the site to backup print off my tickets and got this before the email went out this morning, yea my brain was saying this is a result of a breach of some kind

 

[HantsExile]

Thanks for this and other helpful replies.

I don't need to log into Eurostar right now so will keep an eye on developments.

Have now logged in and reset my password, following helpful advice given here - thanks to all!

 

[Bletchleyite]

This site can be useful to check if your email address or password has been breached. Yes, it is genuine, though you may wish to avoid entering both your email address AND a password you intend to use just in case!

It doesn't seem to know about a Eurostar breach (yet).

If it does show a password you use as breached, don't use it - that means it may be breached via a dictionary attack (where they just try known passwords until they work).

Have I Been Pwned: Pwned Passwords

Have I Been Pwned allows you to search across multiple data breaches to see if your email address or phone number has been compromised.

haveibeenpwned.com

 

[popeter45]

So on a Eurostar today and chatted with staff who say it's due to merging of thalys and Eurostar backend systems, obviously not going as planned as reason I was chatting was because they didn't seem to carry over dietary requirements from old system and new one still won't load

 

[Bletchleyite]

So on a Eurostar today and chatted with staff who say it's due to merging of thalys and Eurostar backend systems, obviously not going as planned as reason I was chatting was because they didn't seem to carry over dietary requirements from old system and new one still won't load

Ah, right, thanks. Reassuring that there has not been a breach, as when this happens it's almost always that there has been one!

 

[Re6/6]

Have received an email saying that I need to log in and reset password. Have tried seven time to log in and told account and password is not recognised and told to request a new password. Have requested that the link for a password reset be sent but this never arrives. Now cannot access my account. Are Eurostar aware that this link is not working? No statement on Eurostar website saying there are difficulties with logging in. When can a resolution be expected? Not the way to treat customers.

 

[Bletchleyite]

Have received an email saying that I need to log in and reset password. Have tried seven time to log in and told account and password is not recognised and told to request a new password. Have requested that the link for a password reset be sent but this never arrives. Now cannot access my account. Are Eurostar aware that this link is not working? No statement on Eurostar website saying there are difficulties with logging in. When can a resolution be expected? Not the way to treat customers.

Have you checked your spam and promotions folders? Those emails often end up there.

 

[Re6/6]

Indeed I have and no emails have been received. This is a real mystery.

 

[Re6/6]

I resubmitted my question again using the Report a Problem icon on the Eurostar Need to Ask A Question functionality.

They got back to me after a couple of days explaining they had undertaken an exercise to upgrade their customer account database. They recommended to access my accounts that I create a new account with exactly the same log on address and that would link to my existing account.

I created a new account exactly as before with a new password and hey presto the link worked and all my future bookings were clearly visible.

Reasonably easy to solve the problem but not clear how to raise the question in the beginning.