Received message below from account SystemAlert15 created today

Complete Verification.

Your ModularGrid account has been temporarily restricted.

We have updated our Privacy Policy. In accordance with the new Privacy Policy, your account will remain under review until the verification process is completed. This step helps us maintain the security and protect the personal data of all our users.

A ModularGrid support representative will guide you through the necessary steps on the verification page.

To verify your information and regain full access to your account, please use the secure link:

https://tinu.be/modulargrid

If you can't click on the link, copy and paste it into your browser (Safari/Chrome, etc.).

Received message below from account SystemAlert15 created today

SystemAlert1, SystemAlert2 to SystemAlert15 wrote the same message.

This is a phishing attempt. It has of course nothing to do with ModularGrid. Do not click any links!
I have suspended all scam accounts, deleted the messages and contacted all users that were targetted.

I got the same message today.

Cheers

For those unaware, spoofed emails can be very convincing and taken for legitimate without you knowing it was spoofed. Spoofed addresses can be made identical to official MG addresses on the surface. Only when you closely inspect the message headers of an email you received, can you tell whether it's legitimate or not. So if in doubt, or if the email contains a link asking you to log in, just delete and ignore it.

Another thing I strongly advise anyone who received a phishing email from MG, is to check if your email address has been exposed in a data leak. Generally, email addresses stay hidden in a website's database unless a leak has happened. This doesn't mean that MG had a data leak (we'd know by know), but it is very likely that your address has been leaked elsewhere and that scammers are just fishing (phishing) for someone who does happen to have an account here. Aged accounts with positive ratings are likely very very lucrative for scammers as they can easily list some modules for cheap, scam several users out of their money and disappear just like that.

Thanks for the detailed info!

Yes, the email did say someting about reactivating my suspended account.
What looked very suspicious was the link ending on be.com or something.

Keep safe!

Another thing I strongly advise anyone who received a phishing email from MG, is to check if your email address has been exposed in a data leak. Generally, email addresses stay hidden in a website's database unless a leak has happened.

this is not the case, the attacker just created dummy accounts and sent phishing messages to ModularGrid users without knowing their email adresses

EDITED Sep 30th, 05:16

For those unaware, spoofed emails can be very convincing and taken for legitimate without you knowing it was spoofed. Spoofed addresses can be made identical to official MG addresses on the surface.

We are using DMARC signed emails. Most emails servers will not deliver spoofed MG emails. Or at least send them to SPAM.

Another thing I strongly advise anyone who received a phishing email from MG, is to check if your email address has been exposed in a data leak.
-- toptier

There was no leak. It's like @pibou said: someone just registered new accounts with username "SystemAlertX" and tried to automate the sending of phishing mails with the MG messenger. We have a limitation of 3 messages per user/hour. This is not to upsell unicorn accounts but to prevent the spammers from spamming to all users. Those of you who got the phishing mail are lucky winners, so to speak.

I do what is reasonable to fight scammers, but at some point security becomes a prison. Nobody wants to fill out a CAPTCHA for every message they want to send, and I think it would be quite excessive to require users to provide IDs or phone numbers just so they can use a modular planner...