Folks,
Three users with high post counts had their accounts hijacked around the same time. In each case, the password was changed, and then the email address associated with the account was changed so that the legitimate user would not be able to recover the password.

I am reaching out to those affected via email with new passwords. If you are affected and have not heard from me, please use the "Contact Us" link and get in touch, but use the email address associated with your account please!

I cannot stress enough: PLEASE pick a password that is difficult to guess, as long as possible, and preferably containing more than just letters... throw some numbers and a punctuation mark or two in there. After this incident I'm pretty sure it's time to examine the password policy for new accounts.

The server does not seem to have been compromised. I'm hoping this incident is due to weak passwords and nothing more...

Edit: it's User Control Panel->Profile->Edit account settings to change your password!

Having taken over the account did the attacker do anything with it? I ask in case he/she took over other accounts but *didn't* change the password on those, and thus might remain undetected but active.

i dont really understand tech stuff on the web but very worrid now about my security online now.Thanks for the warning on this should i close that email account now as it would have been hacked.lol.

why would you want to hack a site like this.....

How do you change your password on here?

The only reference to passwords I can find in the help pages is to get it reset with the "I've forgotten my password" option when you log in.

Aldebran,

Click on User control panel at the top of the screen, then on the left click on Profile, then Edit account settings. You should be on the change password screen.

Well, as a regular user, the only thing one can "do" is to make a post or send a private message. Those affected can check their post history and PM sent box for anything they do not recognise, though I think it's unlikely anything like that was done (because what's the point?)

Here's what I think happened: the attacker specifically went after accounts with high post counts, in the hopes that one or more may have moderator or admin privileges. I am guessing maybe the goal was to steal email addresses for spamming purposes. It's not really clear to me. Either way, these were thought out criminal actions, perpetrated using the Tor network (google that if you're unfamiliar.) Pieces of shit. Spammers really need to be executed...

Some reading material for anyone who may be unsure about what constitutes a strong or weak password:

https://www.reddit.com/r/explainlikeimf ... _strength/

https://en.wikipedia.org/wiki/Password_ ... _passwords

Edit: Also, stronger passwords really don't have to be a pain in the ass. It's totally possible to pick a password at least 10 characters long, containing both upper and lower case letters, one or more numbers and one or more symbols (our requirement now for new accounts) that's still actually easy to remember. For example, something like

would satisfy the requirement. :-)

Edit: This is really cool