Just in case, log into the Character Selection and check if you still have your email address linked to your account under Settings -> Account. If it was changed, you can get it back in the same screen and make sure to update your password on the ESO Website.

I went through the same situation back in 2021, when I discovered my character in Auridon after leaving him in Deshaan the day before. Luckily nothing of value appeared to be lost for me.

Maitsukas wrote: »

Just in case, log into the Character Selection and check if you still have your email address linked to your account under Settings -> Account. If it was changed, you can get it back in the same screen and make sure to update your password on the ESO Website.
I went through the same situation back in 2021, when I discovered my character in Auridon after leaving him in Deshaan the day before. Luckily nothing of value appeared to be lost for me.

I'm wondering: Did you find clear proof that someone had access to your account or were you just checking because of that occurrance? It's not completely clear from the wording.

I'm asking because I had a few minor cases of logging in at a different spot than I had logged out at last year or so. But it only happened within a zone, logging out inside a delve, finding myself outside the delve when logging in the next day. Same with the thieves den, logged out inside, logged in outside of it. But not every time, completely irregularly. As I heard that the same thing happened to others and there were no changes to my account (at least I didn't see anything, but I changed my password just in case), I thought it might be some server update issue?

Djennku wrote: »

Sounds like a scam. They are common and happen everywhere. Whatever you do, do not click the links.

Usually the links point to strange addresses, which one can clearly see in the status bar, but here in this email everything points to the correct addresses.
So, it's all the weirder

SPR_of_HA_community wrote: »

davidtk wrote: »

Djennku wrote: »

Sounds like a scam. They are common and happen everywhere. Whatever you do, do not click the links.

Usually the links point to strange addresses, which one can clearly see in the status bar, but here in this email everything points to the correct addresses.
So, it's all the weirder

Based on text you post - may be some one try to change your password or some data.

Yea but first they musr crack my passwrd. So if they cracked it there is rly problem with account security @ZOS_Kevin because I don't have short easy password...

Anyway I can't even chage it because account system is under maintenence lol

Syldras wrote: »

Maitsukas wrote: »

Just in case, log into the Character Selection and check if you still have your email address linked to your account under Settings -> Account. If it was changed, you can get it back in the same screen and make sure to update your password on the ESO Website.
I went through the same situation back in 2021, when I discovered my character in Auridon after leaving him in Deshaan the day before. Luckily nothing of value appeared to be lost for me.

I'm wondering: Did you find clear proof that someone had access to your account or were you just checking because of that occurrance? It's not completely clear from the wording.

I'm asking because I had a few minor cases of logging in at a different spot than I had logged out at last year or so. But it only happened within a zone, logging out inside a delve, finding myself outside the delve when logging in the next day. Same with the thieves den, logged out inside, logged in outside of it. But not every time, completely irregularly. As I heard that the same thing happened to others and there were no changes to my account (at least I didn't see anything, but I changed my password just in case), I thought it might be some server update issue?

The zone change was the first thing I noticed back then, I immediately looked into my Outlook inbox to see an unread email from ZOS regarding my ESO Account's email address being changed from my hotmail.com to an unknown Indian email address. The IP address where this change occurred was attached with the ZOS email I received as well, which listed random places in Ukraine.

I got a similar email - looks legit but in russian - send to an address I only use for ESO.
Something is screwy

SPR_of_HA_community wrote: »

Some day they phone me and tell me some thing like:
"Mother, i am in trouble, I need money"
I get a lot of fun from it, because I am really a man and have no children ))

One day my neighbour in this house told me that a stranger was ringing at his door while I was away and asked him if he could accept some gift package for some "blonde girl" and pointed at my door why saying that... The thought of a blonde girl hiding somewhere in my appartment (Inside a cavity in the walls? Or inside my wardrobe? Maybe in the laundry basket?) creeps me out

davidtk wrote: »

Usually a character will move to the last non-DLC safe zone if they log out where they can't reload. Something else is a crash.

Can't remember if it also occurred somewhere else, but in my case, it happened on Vvardenfell a few times.

Maitsukas wrote: »

The zone change was the first thing I noticed back then, I immediately looked into my Outlook inbox to see an unread email from ZOS regarding my ESO Account's email address being changed from my hotmail.com to an unknown Indian email address. The IP address where this change occurred was attached with the ZOS email I received as well, which listed random places in Ukraine.

How awful. But at least ZOS does send a warning in such cases, it seems, which is at least a bit reassuring.

If this could help here is the translation of the mail fragment exposed:

---

cut here ----
If that was not you, who attempted logging in, ignore this letter.
If you are not sure about your account security you can reset your password.
We recommend regular chaning your password to keep your account secure.
Don't forget to log out if you used someones' else computer!
If you have questions regarding this e-mail, (please,) visit out support page and we will be glad to help you help.elderscrollsonline.com
Best regards
Elder Scrolls Online team.

---

cut here ----

Bolded by me: letter confirms the login attempt (not necessarily successful), this simply means your @UserID was used (@UserID is highly visible ingame), so most logical assumption is that some robot/newbie-hacker attempted a dictionary attack against all the @UserIDs they have collected.
or your @UserID was remembered at someone else's computer (and box owner entered theirs password not noticing wrong UserID)
or some other gamer targeted your @UserID to crack your password
In the case of successful password guess you should receive one more e-mail to authorize the usage of the new client device.

non-relevant: Italics by me: i expected "please" (which was omitted) in this invitation to open a support ticket, but, as Zeni probably thinks Russians do not deserve any politeness.

I'd suggest to ignore this mail and if your password is shorter that 11..12 characters or it is a dictionary word - to set up a new strong and reliable password. 16 characters non-dictionary including uppercase lowercase numeric and special characters is a good idea. Do not store it on electronic media.

edit:
Cracker is not necessarily Russian, they could use VPN resulting in Russia geo-IP address and/or Russian localized windows OS regardless where they were actually located.

Also: NEVER follow the links in any mail when you suspect fishing. This could be pharming attack - link leading to a malicious site to intercept your login and password!

Account system is still under maintenence, can we get an eta? It should already running, I wanted change my password asap.

Got a couple of these e-mails as well. One thing I noticed though, was that they are using an older template. When I tried to log in myself, the e-mail background and code format were different than of those two.

I changed password right now. Just hoping that wasn't any mistake lol

I recieved one,never even opened it,knowing it is a scam,and just tried logging into game.They jsut spam lots of generated emails hoping ppl open and click.Opening them lets them know it's a real address,cause they hide clear gifs and stuff,it's how they test,unless you got a sandbos or in spam folder where they disable all images,links,etc.

I got 5 emails total, from about 12 hours last night. I logged in from a secure connection from the website itself to check. Everything seems fine. what I want to know is how they got to the recovery screen since they would need to know the login name in the game. Being that my twitch, Xbox, and other platforms are connected to ZoS and the website, this worries me greatly.

Hopefully, someone will take a serious dive into this now that the holiday is over and we can see if the database was actually breached.

MissK