Great Western Rail has taken the precaution of resetting the passwords for all its customers after detecting a limited campaign of password reuse attacks.
As reported by
The Register, the British train operating company detected password reuse attacks against some of its customers' GWR.com accounts. In total, it found that bad actors had targeted 1,000 accounts out of a million. The railway firm responded by notifying all affected customers and contacting the United Kingdom's Information Commissioner's Office (ICO).
No information was available about the attacks on GWR.com at the time of publication.
It's unclear what types of information the bad actors might have stolen if they were successful in gaining access to a customer's account. In a tweet to a concerned individual, it said that it disclosed that knowledge to affected customers only and did not make it publicly known.
https://twitter.com/GWRHelp/status/983993256706035713
Great Western Rail told The Register the incident was limited in scope. But that didn't stop it from sending out an email to all GWR.com account holders informing them it had reset their passwords and that they'd need to protect their accounts with a new combination.
To ensure the security of your personal information you will need to do this when you next log in to the GWR.com website. You should use a unique password for each of your accounts for security, and we recommend you review all of your accounts for maximum security, and we recommend you review all your online passwords and change any that are the same.
Some customers thought the email from Great Western Rail was a scam.
https://twitter.com/lanttans/status/983812007852900353
https://twitter.com/mayfieldmassive/status/983752149673959424
The rail company responded to those concerns by confirming the legitimacy of the email.
To protect their accounts against password reuse attacks, customers should activate additional security features like two-factor authentication (2FA) when web services make them available. They should also protect their accounts with a strong, unique password.
Here are some expert tips on how to do so.
