Suspended MP Accounts / Username Access Disabled / 3rd Party Security Breach-Dec 2014
Dec 21, 2014, 9:30 am
#1
Original Poster
Join Date: Jun 2010
Posts: 400
Suspended MP Accounts / Username Access Disabled / 3rd Party Security Breach-Dec 2014
I tried logging in yesterday and received an error saying my account was locked. When I called in to United today, I was transferred to a supervisor and required to change my PIN, password and new security question. He said this was due to a breach in a third party vendor's security, but would not tell me any more detail. Anyone have experience or information on this?
Dec 21, 2014, 11:30 am
#2
Moderator: Smoking Lounge; FlyerTalk Evangelist
Join Date: Feb 2004
Location: SFO
Programs: Lifetime (for now) Gold MM, HH Gold, Giving Tootsie Pops to UA employees, & a retired hockey goalie
Posts: 28,877
All is fine with my account, goalie-dad, goalie-mom and goalie-sis as I was able to log in to all of the accounts without any issues
Dec 21, 2014, 1:58 pm
#4
FlyerTalk Evangelist
Join Date: Nov 2006
Location: Bangkok or San Francisco
Programs: United 1k, Marriott Lifetime PE, Former DL Gold, Former SQ Solitaire, HH Gold
Posts: 11,886
I tried logging in yesterday and received an error saying my account was locked. When I called in to United today, I was transferred to a supervisor and required to change my PIN, password and new security question. He said this was due to a breach in a third party vendor's security, but would not tell me any more detail. Anyone have experience or information on this?
Dec 26, 2014, 10:30 pm
#5
Join Date: Apr 2014
Posts: 121
Here's the kicker..
I have a VERY secure username AND password set on my account, BUT I can't use them! The only thing that works and allows me to login is my MP account # and my super lame 4 digit PIN! I should be able to say allow access via one or the other, but not BOTH or in my case simply the MP/PIN combo since my account/pass don't work anyway. Why am I even able to set them if I can't use them AND you still allow the other to login anyway??
It seems that a number of airlines do this, why is their security SOOOOO crappy??
Ya know, I'm in a mood so I'm going to write them a nice little note!
-Phanto
I have a VERY secure username AND password set on my account, BUT I can't use them! The only thing that works and allows me to login is my MP account # and my super lame 4 digit PIN! I should be able to say allow access via one or the other, but not BOTH or in my case simply the MP/PIN combo since my account/pass don't work anyway. Why am I even able to set them if I can't use them AND you still allow the other to login anyway??
It seems that a number of airlines do this, why is their security SOOOOO crappy??
Ya know, I'm in a mood so I'm going to write them a nice little note!
-Phanto
Dec 27, 2014, 7:42 am
#6
Join Date: Sep 2002
Location: Bainbridge Island, WA
Posts: 8,953
Anyway to bypass CS when you get a Suspension email?
I got a "We temporarily suspended your account to prevent unauthorized access" email last night. After determining it was not a phish I tried calling and was on hold for 30 minutes ( they said 18). I gave up. This morning I called again...got through in 10 ( they said 3) and the person I got had no idea what to do...put me on hold " to talk to her supervisor"... 20 minutes later I hung up.
I can't listen to that UA music loop anymore....help.
Any thoughts other then patience to get this resolved?
I can't listen to that UA music loop anymore....help.
Any thoughts other then patience to get this resolved?
Dec 27, 2014, 8:43 am
#7
Join Date: May 2011
Posts: 5,814
I got a "We temporarily suspended your account to prevent unauthorized access" email last night. After determining it was not a phish I tried calling and was on hold for 30 minutes ( they said 18). I gave up. This morning I called again...got through in 10 ( they said 3) and the person I got had no idea what to do...put me on hold " to talk to her supervisor"... 20 minutes later I hung up.
I can't listen to that UA music loop anymore....help.
Any thoughts other then patience to get this resolved?
I can't listen to that UA music loop anymore....help.
Any thoughts other then patience to get this resolved?
Dec 27, 2014, 8:57 am
#8
Join Date: Dec 2014
Posts: 2
I got the same email last night and called the 1-800 right away. Apparently no one knew what was going on so I got transferred 3 times and put on hold for 15 minutes. However, in the end of the 30-min call, someone finally reactivated my account. Maybe try calling around after 9pm so they are not that busy?! However, when I asked them what exactly happened to my account, they didn't seem to have an answer to that...
Anyways, good luck!
Anyways, good luck!
Dec 27, 2014, 9:09 am
#9
Join Date: Dec 2009
Location: IAD
Posts: 319
Anyway to bypass CS when you get a Suspension email?
I got this too. Do you, by chance, use AwardWallet? I do, but since the falling out of UAL and AwardWallet, I update my MP account by forwarding my email statements (I have a filter that does this automatically).
Dec 27, 2014, 10:41 am
#10
Join Date: Dec 2010
Location: WAS-ish
Programs: UA 1K-MM + UC, Marriott Plat, National Exec
Posts: 1,341
No advice on how to get through without holding. However, just FYI, Wandering Aramean (see recent blog post) suggests that United suffered a third party data breach on December 24, possibly through Mileage Plus X or Mileage Plus Dining, so a lot of people are getting these emails.
Dec 27, 2014, 10:44 am
#11
Join Date: Sep 2002
Location: Bainbridge Island, WA
Posts: 8,953
A third call and a 20 minute or so wait " for a supervisor" was what it took to reset the account.
They should have enabled a regular Unitedplus CS agent to reset the account instead of having to go through a supervisor. The hold times for a supervisor are through the roof because of all the suspension emails that were sent out yesterday.
Poor planning and instructions.
They should have enabled a regular Unitedplus CS agent to reset the account instead of having to go through a supervisor. The hold times for a supervisor are through the roof because of all the suspension emails that were sent out yesterday.
Poor planning and instructions.
Dec 27, 2014, 7:40 pm
#12
Original Poster
Join Date: Jun 2010
Posts: 400
I do use award wallet and also chase CC's. But the united rep me on 12/21 about the data breach as the reason I needed to change pin and set a password so it must have occurred prior to 12/24, at least for some people.
Last edited by Roka; Dec 27, 2014 at 7:41 pm Reason: Typo
Dec 27, 2014, 7:41 pm
#13
Original Poster
Join Date: Jun 2010
Posts: 400
A third call and a 20 minute or so wait " for a supervisor" was what it took to reset the account.
They should have enabled a regular Unitedplus CS agent to reset the account instead of having to go through a supervisor. The hold times for a supervisor are through the roof because of all the suspension emails that were sent out yesterday.
Poor planning and instructions.
They should have enabled a regular Unitedplus CS agent to reset the account instead of having to go through a supervisor. The hold times for a supervisor are through the roof because of all the suspension emails that were sent out yesterday.
Poor planning and instructions.
Dec 27, 2014, 8:36 pm
#14
Join Date: Mar 2008
Location: London
Programs: UA GS
Posts: 2,438
Here's the full email. I actually took the email to mean they had detected that someone had specifically accessed my account. I also thought I was going to have to change the password via the agent, but all the agent did was re-activate my account so I could quickly login and change everything myself.
We recently learned that an unauthorized party attempted to access your MileagePlus® account with usernames and passwords obtained from a third-party source. These usernames and passwords were not obtained as a result of a United® data breach, and United was not the only company where attempts were made.
Since approximately December 24, 2014, the unauthorized party attempted to access MileagePlus accounts with these usernames and passwords, since many people use the same username and password for multiple accounts and websites. The unauthorized party was able to confirm that the information matched your MileagePlus account log in. They were able to obtain your MileagePlus number, account balance and Premier status, but there is no indication that any other information was obtained. However, there is a possibility that other details in your account profile could be viewed, such as mailing address. Please note that if your profile includes a credit card number, all but the last four digits are masked.
The security of your data is of the utmost importance to us, and we have several safeguards in place to protect your information.
■ As a precautionary measure and in order to protect your MileagePlus account, we have temporarily suspended access to it.
■ Please call the MileagePlus Service Center at 800-421-4655. A MileagePlus agent will work with you to change your password, username, PIN, and security questions.
■ The agent will also review your account profile with you to ensure everything is accurate.
To help us further protect your account going forward, we strongly recommend the following:
■ Avoid using the same username or email address and password that you use on other accounts.
■ Ensure your PIN/password is not easy to guess and that you periodically change it.
■ Regularly review all of your profile information and any other information to ensure that it is accurate.
Since approximately December 24, 2014, the unauthorized party attempted to access MileagePlus accounts with these usernames and passwords, since many people use the same username and password for multiple accounts and websites. The unauthorized party was able to confirm that the information matched your MileagePlus account log in. They were able to obtain your MileagePlus number, account balance and Premier status, but there is no indication that any other information was obtained. However, there is a possibility that other details in your account profile could be viewed, such as mailing address. Please note that if your profile includes a credit card number, all but the last four digits are masked.
The security of your data is of the utmost importance to us, and we have several safeguards in place to protect your information.
■ As a precautionary measure and in order to protect your MileagePlus account, we have temporarily suspended access to it.
■ Please call the MileagePlus Service Center at 800-421-4655. A MileagePlus agent will work with you to change your password, username, PIN, and security questions.
■ The agent will also review your account profile with you to ensure everything is accurate.
To help us further protect your account going forward, we strongly recommend the following:
■ Avoid using the same username or email address and password that you use on other accounts.
■ Ensure your PIN/password is not easy to guess and that you periodically change it.
■ Regularly review all of your profile information and any other information to ensure that it is accurate.
Dec 27, 2014, 9:56 pm
#15
Join Date: Sep 2009
Location: iad/dca
Programs: UA Million Mile Gold, Club, AA, Delta, Marriott, Hertz G, A/Club
Posts: 1,106
I didn't get the email but I tried to log on and was directed to provide MP number and four digit pin rather than email and password I normally use. Message says email and password log ons are suspended. Third party, who would that be? Chase?
Sign In
! We could not process your request. Please see the message below and make revisions.
To sign in, please enter your MileagePlus number and Personal Identification Number and then click Sign In.
Not a MileagePlus member? Enroll online instantly.
! The sign-in information you entered does not match an account in our records. Try again or click on one of the links below to recover or change your sign-in information.
MileagePlus Number (username and e-mail address sign-on are currently unavailable)
Sign In
! We could not process your request. Please see the message below and make revisions.
To sign in, please enter your MileagePlus number and Personal Identification Number and then click Sign In.
Not a MileagePlus member? Enroll online instantly.
! The sign-in information you entered does not match an account in our records. Try again or click on one of the links below to recover or change your sign-in information.
MileagePlus Number (username and e-mail address sign-on are currently unavailable)
