If you received a confirmation email from Smoobu that you never asked for, your account has not been hacked and nothing in it was accessed. An outside party ran an automated check against a list of email addresses it already had, to see which ones belong to a Smoobu account, and Smoobu's system sent the confirmation email automatically during that check. Smoobu's security team detected and blocked the attempt. What the outside party learned is only that your email address is linked to a Smoobu account, and that is why this article asks you to take three short precautions.
What happened
An external party brought a list of email addresses collected somewhere else, entirely outside Smoobu, and tested them against Smoobu to find out which were active accounts. Each test made Smoobu send a confirmation email to the address, which is the unexpected email you received. Smoobu's security team detected the activity and blocked it.
No Smoobu database, password, payment information or personal detail was accessed or taken. The party did not get into your account; it already had your email address and now knows that address is connected to Smoobu.
Why it still matters
Because someone outside Smoobu knows your address belongs to a Smoobu account, they may try phishing: emails that look like they come from Smoobu and ask you to log in, confirm a password or "verify" your details on a page they control. The three steps below make such an attempt fail.
Steps
- Make sure your password is strong and unique. Your password was not exposed, so you only need to change it if it is short, easy to guess, or one you also use on another service. To change it, click your profile icon at the top right, then Manage Account; under Settings, click Change password. If you cannot log in, use Forgot your password? on the login screen instead: I can't log in to Smoobu.
- Turn on 2-factor authentication. On the same Manage Account page, switch on the 2 Factor toggle. From then on, a login needs a code that Smoobu emails to you as well as your password. The full walkthrough, including what to do if the code does not arrive: Protect your account with 2-factor authentication.
- Check the sender of any email that claims to come from Smoobu before you click a link or type a password. Smoobu never asks you for your password, your login details or personal information by email, and this article deliberately gives you no link to a password page: open Smoobu yourself in your browser and make the change there. If an email asks for any of these, do not reply and do not click.
Check it worked
Log out and log in again. With 2-factor authentication on, Smoobu asks for your password and then for the emailed code. If you did not receive a code, the 2-factor article explains where it goes and what to check.
Common problems
You clicked a link in a suspicious email
If you typed your password on a page that was not Smoobu, treat that password as known to someone else: change it in Smoobu now (step 1 shows where) and everywhere else you used it, and turn on 2-factor authentication if it is not already on. If you only opened the page and typed nothing, no password has left your hands; step 3 is enough.
You use the same password on other services
Change it on those services too. The risk from this incident is limited to Smoobu, but a password that is reused is only as safe as the least protected place it is used.
You want to know whether your data was affected
It was not. Nothing was read or taken from Smoobu; the outside party only confirmed that your email address is linked to an account. If you have a question about your specific case, contact Smoobu Support from inside your account.
Related articles
- Change your account email, password or details
- Protect your account with 2-factor authentication
- I can't log in to Smoobu
Still stuck?
If this didn't answer your question, the Smoobu team is happy to help. In Smoobu, open the Help menu to open a ticket or book a call slot, or use the chat bubble in the bottom-right corner for a quick question during business hours.
Comments
0 comments
Please sign in to leave a comment.