4 ms·

Anecdotal: Got hit with a password lock on a pretty unused Instacart account ~7 days ago (Jul 15). Possibly a password leak from another site resulting in a ta

Anecdotal: Got hit with a password lock on a pretty unused Instacart account ~7 days ago (Jul 15). Possibly a password leak from another site resulting in a targeted large-scale account access to download customer data from a leaky API? (Baseless commentary.)

bowmessage 6y ago
+1 to your anecdote on Jul 16.
wakkaflokka 6y ago
Exact same thing happened to me a few weeks earlier - July 2nd. Said my account was locked due to too many unsuccessful login attempts. I hadn’t used Instacart in years. Reminds me to delete unused accounts!
cco 6y ago
I had a similar thing happen last week with DoorDash, after the first two I contacted their privacy@ address and requested an account deletion via CCPA.
- dylan604 6y ago
  Isn't that closing the barn door after the horses left?
  - wastedhours 6y ago
    Not necessarily - if you catch it on unsuccessful login attempts and have no evidence they got into the account, it's likely they moved onto the next email address in their list and you can still go in and delete the account pre-compromise.
Keverw 6y ago
Interesting! I get random password resets for Facebook, Instagram and some others... Probably some hackers using a script... Then if people do that, wonder if they also try to signup people? That would explain things maybe... Like some sites don't verify emails for signups, had someone sign me up for Spotify on an email of mine, when I don't have an account using that email. Never verified the email but got login notification emails... I reset the password and deleted the account. Then I get emails saying they are from Anna at Netflix wants to chat with me "If you’d like to chat before you start your subscription"... Idk if they like typed in my email and never finished signing up or what but creepy... I have heard some sites log uncompleted signups even if you never clicked submit. Kinda makes me wonder if these people selling breach data sets would sign people up too then if it's a email someone used elsewhere, to bulk up the numbers of users in their so called breach by adding newly created accounts, along with valid email/passwords harvested from other breaches. Then probably an inflated number would make their dataset be worth more money to people trading the datasets on the dark web I'd guess.
marz0 6y ago
This also happened to me last week on the 15th.
Vekz 6y ago
Same thing here
mcphilip 6y ago
Same here, I haven’t used Instacart in months and my account was locked on July 12th from bad login attempts.

bowmessage 6y ago

+1 to your anecdote on Jul 16.

wakkaflokka 6y ago

Exact same thing happened to me a few weeks earlier - July 2nd. Said my account was locked due to too many unsuccessful login attempts. I hadn’t used Instacart in years. Reminds me to delete unused accounts!

cco 6y ago

I had a similar thing happen last week with DoorDash, after the first two I contacted their privacy@ address and requested an account deletion via CCPA.

dylan604 6y ago
Isn't that closing the barn door after the horses left?
- wastedhours 6y ago
  Not necessarily - if you catch it on unsuccessful login attempts and have no evidence they got into the account, it's likely they moved onto the next email address in their list and you can still go in and delete the account pre-compromise.

Keverw 6y ago

Interesting! I get random password resets for Facebook, Instagram and some others... Probably some hackers using a script... Then if people do that, wonder if they also try to signup people? That would explain things maybe... Like some sites don't verify emails for signups, had someone sign me up for Spotify on an email of mine, when I don't have an account using that email. Never verified the email but got login notification emails... I reset the password and deleted the account. Then I get emails saying they are from Anna at Netflix wants to chat with me "If you’d like to chat before you start your subscription"... Idk if they like typed in my email and never finished signing up or what but creepy... I have heard some sites log uncompleted signups even if you never clicked submit. Kinda makes me wonder if these people selling breach data sets would sign people up too then if it's a email someone used elsewhere, to bulk up the numbers of users in their so called breach by adding newly created accounts, along with valid email/passwords harvested from other breaches. Then probably an inflated number would make their dataset be worth more money to people trading the datasets on the dark web I'd guess.

marz0 6y ago

This also happened to me last week on the 15th.

Vekz 6y ago

Same thing here

mcphilip 6y ago

Same here, I haven’t used Instacart in months and my account was locked on July 12th from bad login attempts.