BurningLegs
Guru
Feel free to send me a PM - I lead cyber security for a manufacturing company.Completely off topic, but I've just had an email from my hotel loyalty card saying someone rang them and changed the email address associated wit my account. Since then I'm getting 4-5 emails a minute from various subscriptions being set up on my email.
Anyone experienced anything like this and any suggestions?
First thing I would suggest is to change your password on all email and finance/purchasing accounts and setup something called MFA (Google call it 2FA). Definitely do eBay, Paypal, and Amazon.
Second, check you don't have malware on your computer. Just use your normal anti-virus but make sure it is up to date.
Then contact your banks and tell them what's been going on.
Do all of the above ASAP.
This is often the result of something called "credential stuffing" where bad guys take some usernames/passwords that have been leaked online and try to use them on lots of different websites/services. Almost everyone uses the same password for at least two services, so if your username for LinkedIn is abc@123.com and password is "EasyPassword1" then the chances are that username/password combo could work at GMail, Yahoo! mail, other social accounts, Netfliex, etc etc
A great resource I would encourage everyone to use is this website, which shows you how many times your personal information is known to have been lost and is publicly available - https://haveibeenpwned.com - you enter your email address and then it confirms whether personal info related to that email address has ever been lost, and what was the source of the disclosure. Most people have been effected at this is the starting point for most attackers - take the usernames/passwords that have been lost and see if there are any services on the internet using that combination of username/password.
It is unlikely the attackers will gain access to your bank accounts this way, but inform your bank anyway. They'll probably ask you to change your password.