BT Email users hit by barrage of unsolicited password reset PINs

BT Email customers say they have been bombarded with hundreds - and in one case more than 1,000 - unsolicited password reset messages, leaving the telco investigating what is causing the deluge. The reports began appearing on BT's community forums over the weekend, with customers describing sudden bursts of PIN messages arriving within minutes despite them making no attempt to reset their passwords. One customer said they received between 50 and 70 PIN texts "in the space [of] a few minutes," while a second reported more than 100. A third said the number had passed 500, and another claimed to have received more than 1,000. One BT customer who contacted The Register separately said they had received around 300 password reset emails over the previous 24 hours, typically arriving in bursts of around 50 within a minute before stopping for several hours. BT has acknowledged the problem but has yet to explain what is behind it. "We are aware that some customers have received a large number of password reset pin messages and we are actively investigating the cause of this," a BT moderator said on the company's community forum. "If you have received multiple messages like this, please ignore them and remain vigilant for any unusual activity with further messages or unexpected calls." BT added that customers' email accounts are secure and that those receiving the messages do not need to take any action. At least one customer, however, claims someone accessed their account during the PIN barrage. The user said they lost access to both their email and BT ID overnight, but managed to request a PIN before whoever was accessing the account could change the telephone number attached to it. That account has not been independently verified, and it isn't clear whether the apparent takeover was connected to the flood of PIN messages. The cause of the wider problem remains a mystery. It isn't yet clear whether it's the result of someone deliberately hammering a password recovery mechanism, a fault within BT's systems, or something else entirely. The Register has asked BT how many customers are affected, whether the messages are being generated by external password-reset attempts, and whether it has found any evidence of malicious activity. We've also asked the telco what rate limiting it applies to password reset requests, given reports of hundreds of PINs arriving within minutes, and whether both email and SMS messages are affected. BT says it's investigating. In the meantime, some customers are getting enough PINs to start their own lottery. (R)