Npower shuts down its mobile app after ‘credential stuffing’ hack

Npower has today scrapped its mobile app amid fears hackers may have gained access to customers’ personal data – including bank details.

Bosses behind energy giant, a ‘Big Six’ firm, are warning customers to check their bank statements for unusual activity following the breach.

It is thought hackers have gained access to contact details, addresses and partial financial details such as sort codes.

Hackers are said to have used stolen details from other websites to gain access to customers’ accounts on the Npower app.

Npower deactivated its app after the hack, but has now decided to scrap it completely, according to MoneySavingExpert.

Customers are being warned to change any other accounts they might have with the same user name and password. 

Digital privacy expert Ray Walsh said the incident was a ‘huge lapse of security’ from Npower.

Bosses behind energy giant, a 'Big Six' energy firm, are warning customers to check their bank statements for unusual activity following the breach.

Bosses behind energy giant, a 'Big Six' energy firm, are warning customers to check their bank statements for unusual activity following the breach.

Bosses behind energy giant, a ‘Big Six’ energy firm, are warning customers to check their bank statements for unusual activity following the breach.

Mr Walsh, an expert for ProPrivacy, said: ‘This has put consumers at substantial risk, and it will now be down to the Information Commissioner’s Office to investigate to figure out whether they deserve a fine.’

Credential Stuffing: How hackers broke in 

Credential stuffing is a type of cyber attack where stolen login details – such as user names and passwords – are used to gain access to other accounts.

The data is typically stolen through data breaches on other websites, and relies on customers using the same login and password details for multiple accounts.

A 2019 survey by Google found 51 per cent of internet users admitted that they use one particular ‘favourite’ password for the majority of their accounts.   

In a credential stuffing hack, computer software is used to input thousands or even millions of stolen logins in the hope that a fraction will have an account on that website or app.

Once in, hackers will then extract more details which they can use themselves or sell on to other hackers. 

<!—->
Advertisement

MailOnline has contacted Npower for a comment and is awaiting a response.

According to MoneySavingExpert, Npower says customer accounts were accessed using login data obtained from other websites in a type of attack known as ‘credential stuffing’.

It is a common technique used by hackers, who take stolen login data from other websites to access an account.

For instance, if someone’s login email address and password has been stolen from another website, hackers can then attempt to use it on other websites.

If a person uses the same user name and password details across multiple websites, this can be used to access all of those accounts.  

According to MoneySavingExpert, personal information including contact details, date of birth and address may have been viewed on the Npower website.

Partial financial info, including sort codes and the last four digits of customers’ bank account numbers, may have also been accessed.

Npower won’t say exactly when the hack took place and how many customers have been affected, according to MoneySavingExpert.  

However, it is understood Npower has advised all customers whose accounts were accessed to change their passwords as a general precaution. 

Mr Walsh meanwhile has warned customers could now be hit with a flurry of phishing emails.

He added: ‘Hackers now have access to all the user credentials and passwords from the Npower app, which means that consumers must change any additional accounts they might have with the same password. 

According to MoneySavingExpert, Npower says customer accounts were accessed using login data obtained from other websites in a type of attack known as 'credential stuffing'. Pictured: The Npower website remains up, though the online app has now been taken down

According to MoneySavingExpert, Npower says customer accounts were accessed using login data obtained from other websites in a type of attack known as 'credential stuffing'. Pictured: The Npower website remains up, though the online app has now been taken down

According to MoneySavingExpert, Npower says customer accounts were accessed using login data obtained from other websites in a type of attack known as ‘credential stuffing’. Pictured: The Npower website remains up, though the online app has now been taken down

‘Otherwise, anyone that has reused the same password from the Npower app on another service could end up with that account also hacked.  

‘The probability that consumers will also now receive phishing emails is high, so it is essential that consumers watch their inboxes carefully for any emails that coerce them into following links or ask for personal information.’

Meanwhile, Helen Knapman, assistant editor – news and investigations – at MoneySavingExpert.com said: ‘More and more we’re seeing crooks turn online for the chance to get their hands on your hard-earned cash, whether directly or by stealing personal details which could help them carry out scams.

‘It appears this is what’s happened in this Npower data breach.’

Link hienalouca.com

Advertising:

Tips to Find Low Priced Luxury Holiday Package Deals Fast

For most families, it has already been a common practice to spend the Holiday season in a foreign location. This is caused by the aviation market changes which have given a lot of benefits for people who travel a lot. Airfares going to different tourist destinations are becoming more inexpensive. What does this mean? If there is a perfect time to purchase luxury holiday package deals, now it the right time! Based on the market trend nowadays, you can save both money and time when you go for a luxury holiday. There are countless offers that combine travel and accommodation in one package which is a lot cheaper than getting separate deals. Aside from that, it is also risky to individually book the services that you need for the vacation. You might end up missing out on some important details of the trip. Unlike when you take advantage of luxury holiday package deals, you can be sure that everything is organized meticulously and according to what you really need. Nonetheless, you would still need to carefully select the package that would fit your needs. Review the following tips in getting packages that are reasonably priced. · Normally, luxury tour packages include accommodation, flight travel and transportation to individual tourist destinations. It would be best to choose the complete package so you won’t have to worry about other vacation elements. In addition to that, these are the packages that have the biggest discounts. · You can get big mark down prices, if you will purchase more packages. It is not a bad idea to share the wonderful moment with your loved ones. By doing so, you would not only enjoy, you will also save more money. You can even use your savings for other activities on your vacation. · It would be best to know how much you are willing to pay for the luxury tour packages. You can already work around your budget. You have to stick to your budget. If not, you might end up spending a lot and you will be left with less money for your vacation. · Prices may vary depending on the destination of the tour. You can do a research about places that are attractive yet inexpensive. There are thousands of destinations and you just have to choose wisely. · There are packages that include recreational activities. This means that you are paying for all the activities when you purchase these packages. The right thing to do is to make sure that the activities that are included would be the ones that you really enjoy. There is no sense in paying for activities that will not really make your vacation memorable. If you are going with friends, you should also consider their preferences so that you can be sure that everyone will enjoy the trip. There are other ways on how you can be sure that you are getting the best deal for your luxury holiday vacation. No matter how you choose to do it, you have to get adequate information about the packages. This will help you determine whether it is worth the price.

(Total views: 5 Time, 1 visits per day)

Leave a Reply