AIBU to think Next online caused this? (Password scam - have you had one too?)

[StupidScam]

I got one of those password scam emails, where they put your actual password in the subject line, say they have your phone and Facebook contact list and have all your computer activity, and if you don't pay them they'll send all your contacts embarrassing things like the 'porn' you've been watching and webcam footage of you enjoying it!

Obviously it's rubbish but they have correctly gotten my email address and password from somewhere. I've checked haveibeenpwned.com/
but it occurs to me that this arrived 10 minutes after I changed my password (to the 'revealed' one) on my Next online shopping account. I did a password reset because I'd forgotten my password.

I've changed it again to something unique to that login, and have tried to change it anywhere else I've used it. However last time I ordered from Next I logged in again and found a weird address had been added to my account (nowhere near where I live) - I rang Customer Services who removed it and as far as I can remember indicated that someone had gotten into my account who shouldn't. This is what makes me suspicious!

I've seen a few MN posts recently about the same scam and wondered if anyone had updated their Next.co.uk password beforehand? The site doesn't seem massively secure, and I have been using internet accounts, shopping etc for years and not had repeated problems with any one account since now (oh, apart from Netflix - and it's not my Netflix password).

[LayItDown]

I didn’t get an email like that, but my Next account did get hacked last week! The scammers managed to change my password, email address, added two new addresses and ordered a bunch of crap.

My password was admittedly an old one, but I’ve not used the account for a year and don’t use any passwords like that anymore.

What I noticed which is really dodgy about the next site - you only need your customer number and date of birth to place an order. You don’t even need to sign in with a password. But you did need a password to check, track or cancel your orders.

[StupidScam]

you only need your customer number and date of birth to place an order
Wow that's terrible - but I don't have any cards saved to my account at least.

[LayItDown]

No, me either thankfully. And Next were really helpful when I could finally get through to them. But I’ve since had a random order for a teddy bear and dress turn up at my house that I need to return now.

[Nicknacky]

I have had the scam email but the next account we have is my husbands and not linked to me, so it might just be a coincidence.

[aLilNonnyMouse]

I'd scan your PC for a keylogger just in case. It could have picked up what your new password was.