Account Protection & Incident Response

Why Criminal Groups Target Individual Email Accounts

It is easy to assume that only banks, large companies, or wealthy or famous people are worth attacking. In reality, ordinary individual email accounts are targeted constantly, and often deliberately. Much of this activity is not the work of a lone individual, but of organized criminal groups that treat account theft as a business.

There are several reasons an everyday email account is valuable to these groups:

Your email account is the key to everything else

Think about how many other services are connected to your email address. Online banking, shopping accounts, social media, utility and phone accounts, medical portals, and government services almost all rely on your email address for sign-in, notifications, and — critically — password resets. Whoever controls your email inbox can often request a password reset for those other accounts and receive the reset link directly. This makes email a master key that unlocks far more than email itself.

Attacks are automated and inexpensive

Criminals rarely target one person at a time by hand. They use automated tools to attempt logins against millions of accounts, to send millions of phishing messages, and to test stolen passwords across many services at once. Because the cost of each attempt is almost nothing, attackers do not need a specific reason to target you. Your account is attacked simply because it exists and can be reached.

Stolen passwords are traded in bulk

When any website suffers a data breach, the email addresses and passwords from that site are frequently collected, combined with data from other breaches, and sold or shared among criminals. Because many people reuse the same password in more than one place, a password stolen from one unrelated website is often tried against email accounts, and it works far more often than it should. This technique is known as credential stuffing.

A trusted account is a better weapon

A message coming from a real, established email account — yours — is far more convincing than a message from a stranger. Your account carries a history and a reputation with your contacts and with mail systems around the world. To an attacker, taking over an account you already own and trust is more useful than creating a brand-new fake one.

What Attackers Hope to Gain by Controlling Your Account

Once criminals gain control of an email account, they have a number of ways to profit from it. Understanding these motives helps explain why account security matters so much, and why Pacific Internet acts quickly when we detect a problem.

Resetting the passwords of your other accounts

As described above, control of your inbox often means control of everything that uses it for password recovery. An attacker may quietly reset the password on a bank, payment, shopping, or investment account, then drain funds or make fraudulent purchases before you notice.

Financial theft and fraud

Attackers search a captured mailbox for anything with financial value: banking messages, invoices, tax documents, saved receipts, gift-card codes, and stored payment details. They may also use your account to redirect a payment you were expecting, or to send a fraudulent invoice to someone who trusts you.

Impersonating you to defraud your contacts

Your friends, family, coworkers, and customers trust messages that come from your address. Attackers exploit that trust by sending urgent requests for money, gift cards, or wire transfers, or by asking your contacts to open a malicious attachment or link. These “help, I’m in trouble” and fake-invoice scams are far more effective when they genuinely come from your real account.

Harvesting personal and identity information

A mailbox is a detailed record of your life: your full name, address, phone number, birth date, employer, family relationships, account numbers, and more. This information can be used to commit identity theft, open accounts in your name, answer security questions, or build a convincing profile for future fraud.

Sending spam, scams, and malware at scale

A working email account is a resource attackers can rent out or use directly to send spam, phishing, and malware to large numbers of people. Because the mail originates from a legitimate account and server, it is more likely to reach inboxes than mail from a known-bad source.

Quietly monitoring you

Not every intrusion is loud. Some attackers set up hidden mail forwarding rules or filters so that copies of your incoming mail are secretly sent to them, or so that security warnings are automatically deleted before you see them. This lets them watch for valuable messages — and stay in control — long after the initial break-in.

Selling the access

Even if an attacker has no immediate use for your account, working access to it is a product. Valid accounts are bought and sold among criminals, so one break-in can lead to many different people misusing your account over time.

The Risks to You If Your Account Is Compromised

The consequences of a compromised email account can extend well beyond a few unwanted messages. Depending on how the account is used, the impact on you can be serious and long-lasting.

How Pacific Internet Responds to Account Security Incidents

Pacific Internet performs routine security scans and evaluates account activity across our mail systems in order to protect our subscribers, our network, and the reputation of our service. When an account shows signs of compromise, our priority is to stop the abuse quickly, limit the harm to you and to others, and help you regain secure control of your account.

How we detect a problem

An account may be flagged for review when we observe activity that is inconsistent with normal use, such as:

• Large volumes of outbound mail, or sudden spam- or phishing-like sending patterns
• Sign-ins from unexpected locations or from many different addresses in a short period
• A pattern of failed login attempts consistent with password-guessing or credential-stuffing attacks
• Reports from recipients or other mail providers that mail from the account is fraudulent or abusive
• Other account activity that suggests an unauthorized third party may have gained access

Placing the account on security hold

If our review determines that an account is compromised, we place it on a security hold. This is a protective lock that immediately stops the account from being misused while we work with you to secure it. When an account is on security hold:

• The account is locked so the stolen password can no longer be used to reach it. This stops an unauthorized third party from continuing to read your mail or send messages in your name.
• Your existing email is moved to protected storage, exactly as it was. Nothing is deleted.
• New mail continues to arrive and is safely stored while the hold is in place.
• Your mailbox is temporarily replaced with a security notice that explains what happened and asks you to call us, so you are not left wondering why your mail looks different. The notice is the reason many customers arrive at this page.

Restoring your access

Restoring your mailbox is straightforward, and we aim to do it as quickly as possible. To lift a security hold, we work with you to confirm the account is genuinely back in your hands. This generally requires:

• Contacting Pacific Internet by phone at (707) 468‑1005 so we can help you directly.
• Verification of account ownership, so we release the account only to you.
• Changing your password to a new, strong password that has never been used elsewhere, so the old stolen password no longer works.

Once your password has been changed and your account secured, we promptly restore your normal mailbox — with your existing messages and any mail received during the hold intact. Pacific Internet reserves the right to keep an account on hold if it continues to exhibit suspicious, abusive, or compromised behavior.

How we will — and will not — contact you

If we need to act on your account, we will contact you using the phone number or contact information on file, or through a notice you can verify. We will never ask you to reply with your password, and we will never send you a link demanding that you “verify” your account to avoid suspension. If you receive a message like that claiming to be from Pacific Internet, treat it as a scam and contact us directly using the details at the bottom of this page.

How to Protect Your Account

Most account compromises are preventable. The two things that protect you most are a strong, unique password and a healthy skepticism toward messages that ask you to log in, pay, or act urgently.

Use a strong, unique password

Your password is the single most important lock on your account. A good email password should be:

• Unique to this account. Never reuse your email password on any other website. If another site is breached, a reused password hands over your email too.
• Long. Length matters more than complicated symbols. A passphrase of several unrelated words is both strong and easier to remember than a short, cryptic password.
• Not based on personal information. Avoid names, birthdays, pet names, addresses, or anything a stranger could learn about you.
• Not a common word or pattern. Avoid predictable choices such as password, 123456, qwerty, or a word followed by a single number.

A simple, strong approach is to combine several random, unrelated words into a passphrase, for example:

These are examples only — do not use them. Invent your own, and use a different one for every important account.

Consider a password manager

Remembering a different strong password for every account is difficult, and that difficulty is exactly why people reuse passwords. A reputable password manager creates and stores long, unique passwords for you, so you only need to remember one strong master password. This is one of the most effective single steps most people can take to improve their security.

Recognize phishing and don’t take the bait

The most common way passwords are stolen is not high-tech guessing — it is tricking you into typing your password into a fake login page. Be cautious with any message that pressures you to act:

For a fuller explanation of phishing, spoofed sender names, and fraudulent websites, see our Email Security page.

Everyday habits that keep you safe

• Never share your password with anyone, including anyone who claims to be technical support. No legitimate provider needs your password.
• Type important web addresses yourself rather than clicking login links in email.
• Keep your devices and mail software updated so known security holes are fixed.
• Use anti-malware protection and be cautious with unexpected attachments and downloads.
• Be careful on shared or public computers and always log out when you are finished.
• Check your account occasionally for unfamiliar forwarding rules, filters, or messages you did not send.
• Change your password promptly if you learn that any website you use has been breached, or if you ever entered your password somewhere you are not sure about.

If You Think Your Account Has Been Compromised

If you notice warning signs — messages you did not send, contacts reporting strange mail from you, password-reset notices you did not request, or missing mail — act promptly:

1. Change your email password right away to a new, strong password you have never used anywhere else.
2. Change the password on any other account that shared that password, starting with banking, payment, and important accounts.
3. Check for unauthorized changes, such as mail forwarding rules, filters, or an altered reply-to address, and remove anything you did not set up.
4. Review your Sent and Trash folders for messages you did not send, which can tell you and your contacts what the attacker may have done.
5. Warn your contacts if scam messages may have been sent in your name, so they do not fall for them.
6. Contact Pacific Internet support so we can help you secure the account and restore any service that was suspended for protection.

Questions?

If you have questions about protecting your Pacific Internet email account, or you believe your account has been compromised, please contact Pacific Internet support directly at support@pacific.net or (707) 468‑1005.