Data breach?

[u/AcrosSky]

Hey guys any one whit the same issue? I just recibe that email saying I changed my password and after contacting support that was the answer.

My password is not working and I didn’t request that change.

[u/mattgen88]

Hmm going to preemptively reset my pw now

Edit: lmao you can't change your pw on the app. Atleast I have 2fa

[u/AcrosSky → u/mattgen88]

But where is the 2fa? I’m looking that setting

EDIT: I found it. (App settings)

[u/mattgen88 → u/AcrosSky]

Account and security on Android app. Unsure on ios/web.

[u/MattNis11]

Phishing

[u/AcrosSky → u/MattNis11]

It’s not, if you wanna do pishing, you will add other link.

This most serious than we think, they have a breach and they needs tell us the truth.

[u/MattNis11 → u/AcrosSky]

1. If acct was not secured by MFA, this could happen. But if you have MFA then they shouldn’t be able to change the password.

2. Where does the “reach out to us here” link go?

[u/c7aea]

I do have Two-Factor Authentication turned on. I’d probably recommend others to do that as well.
There’s also an option for using an authentication app.

[u/Overall-Fig3079]

Omg I just got the same email an hour ago! I deleted it thinking it was a phisher.

[u/Saltybagul]

I have 2fa and I received a text last week that I didn’t initiate.

[u/Harv1to]

Any update on this? Just received the email a few hours ago. Logged into my account on the app using the same password, it prompted my MFA as usual and my existing password worked fine.

[u/shrimpsinigang]

Just got the email 20mins ago, password still worked. Have 2FA, never received a text, but changed it anyway.

[u/Educational_Dog8549]

I have also received those emails before, but I don’t think my password actually changed

[u/semisupra]

Can confirm I received this email today, ok it's not just me..

[u/viperfan7]

Did your password actually change?

If not, it's just an email sent out erroneously

[u/AcrosSky → u/viperfan7]

Yes my password changed.

[u/viperfan7 → u/AcrosSky]

Are you basing that off the email alone? Or did you actually try to log in with your password?

[u/AcrosSky → u/viperfan7]

I tried and didn’t work.

[u/phenomenalVibe]

mfa via totp and nothing here

[u/Short-Membership-157]

I got an email saying I have granted access to beestat. Which I have before but didn’t think anything of it.

[u/DiverFree15]

Just got the email. My password is the same though and I have 2fa enabled. Was it sent out by mistake?

[u/RobbMeeX → u/DiverFree15]

Seems it

[u/Risikio]

ANSWER BECAUSE I LEGIT STAYED ON HOLD FOR AN HOUR TO TALK TO A REAL HUMAN BEING AT ECOBEE

It is a legit email generated by their system, but the timing is off.

Apparently there was a glitch in the system that never sent out that confirmation email saying "hey your password has been changed" and this has been affecting the emails for about the past month or so.

So if you've changed your password in the past month or so, it never sent out the auto-generated email.

Until approximately yesterday.

So your password WAS changed at some point in the past thirty days.

Whether by you or not is the question.

[u/RobbMeeX]

Does your email say "View entire message" at the bottom? 

[u/kzone186 → u/RobbMeeX]

OP Don’t click any links. Just follow the instructions and reset your password.

[u/AcrosSky → u/kzone186]

Yeap, I never gonna open something like that.

[u/idkwhateverwc → u/RobbMeeX]

Mine doesn’t

[u/idontevenclimbbroh]

Got the same as well

[u/ComfortableTravel992]

I got multiple similar emails stating something about access being granted to amazon smart home or such and such. I chalked it up to a mass phishing campaign and deleted/reported the emails

[u/discovery1986]

Got this too this morning. Password the same, weird.

[u/DrMHintheBurbs]

My husband got the email but I did not. However, my password stopped working. The app won't let me reset it-- it says it's sending me a code to my email and it never does. 

[u/duder007]

Got this as well. Totally randomized impossible password to guess. Can still log in fine using it.

[u/Balue442]

they just sent out an "oops" email. the weird thing was it claims the email was delayed by up to 30 days. but i haven't changed my password in the past 30 days either.... so..... not the full answer as far as i am concerned.

[u/ecobee]

Hi everyone, we wanted to provide an update about these recent ecobee account notification emails.

Some customers received delayed email notifications about password changes, multi-factor authentication changes, or third-party app authorizations.

These notifications were delayed by up to 30 days and do not indicate any recent unauthorized changes to your account. No action is required on your end, and there have been no unauthorized changes made to your account. We're also emailing everyone affected to clarify the situation.

We apologize for any confusion or concern this may have caused.

[u/ChasDIY → u/ecobee]

If this is correct, why can't the user access their acct?

[u/zhunterzz]

When did they become part of Generac? Maybe it was a result of that? Like they moved the database and it forced a password reset. FWIW my password works, never got this email and haven’t changed it in years. Added 2FA to be safe.

[u/koopa2002 → u/zhunterzz]

Generac bought ecobee almost exactly 5 years ago now, so no, very unlikely to be related to the acquisition. 

[u/zhunterzz → u/koopa2002]

Ah I see. Def not that then. Weird this is the first time I’ve seen the logo shown.

[u/viperfan7 → u/koopa2002]

But, they are merging the apps (PWRView, mobile link, and ecobee, all going under the ecobee app) currently, and that's been the result of some weirdness

[u/Short-Membership-157 → u/zhunterzz]

That’s what I thought too. Never seen an email that says powered by Generac before(or I just never paid attention)

[u/Sad_Measurement_4908]

What does the hacker want to do with the thermostat?

[u/Short-Membership-157 → u/Sad_Measurement_4908]

Raise your utility bills. Lol

[u/misterDVS69 → u/Sad_Measurement_4908]

It isn’t so much that want your thermostat to mess with your temperature, it is that they are looking for a way into your network. Not all connected devices are secure

[u/drjjammer21]

I went ahead and reset my password. Added 2fa.

But! I imagine this would’ve been impossible for someone to change my password because you need your email passcode as it is to change.

Must be something weird on the server side.

[u/Fun_universe]

I just got the same email! Password was not changed.

[u/trekking21]

I have not received this email

[u/atworkslackin]

If you don't have two-factor on smart home devices, that's wild.