Plus Net Compromised.

Printable View

May 17th, 2007, 12:14 PM
steve.milner

Plus Net Compromised.

I received the following email from plus net (www.plus.net) support today:

Username: xxxxx

Dear xxxx,

This email contains important information about a problem with our Webmail service which may have lead to your email address being exposed to a spammer.

If you are affected by this, you may have noticed an increase in the amount of spam received since Sunday 13th May. This includes spam to email addresses that were previously spam-free. This increase in spam is a result of a security issue on our Webmail service. You can read about this on the Service Status pages of the Usertools website: http://usertools.plus.net/status/archive/1179240249.htm

I would like to make it clear that the Webmail platform is separate to the systems we use for storing personal information such as credit card numbers and none of this type of information has been exposed as a result of this issue. However, purely as a precaution we would advise you to change your account password by visiting the Member Centre then clicking Account Details then Change Password.
Please note if you change your account password this will need to be updated in your router or modem as well as your browser and email software.

I am extremely sorry that a malicious third party has managed to gain a list of email addresses from one of our Webmail servers. On behalf of PlusNet I would like to sincerely apologise to you for this security breach and the increase in offensive spam emails that may now be affecting your email address. We understand how annoying and upsetting spam email can be and we are treating this with the utmost seriousness. My team and I will continue to work round the clock to reduce the inconvenience caused to you by this problem as much as we can.

When we learned of the attack on our Webmail service, we identified the source of the vulnerability and implemented a fix as quickly as possible. However, following a full audit of our Webmail service we identified a number of additional security vulnerabilities that it has not been possible to patch. While these potential vulnerabilities have not been exploited, we are not prepared to compromise on customer security so we have removed our Webmail service.

We intend to replace our current Webmail system as quickly as we can, and this is one of the next priorities for my team at this time. In the meantime, if you use Webmail to check your PlusNet email from your own PC, you might find it more convenient to use an email program which runs on your PC instead. You can find information about setting up most popular email programs at http://www.plus.net/support/email/se...up_guide.shtml

If you have been receiving spam email to any of your mailboxes, then you could also reduce this by taking some or all of the actions recommended here: http://www.plus.net/support/security..._problem.shtml

This incident has highlighted the importance of keeping systems as secure as possible. It is important to ensure that you always have the latest operating system updates and patches installed. Windows users can obtain these by visiting Windows Update, which is linked to from the Tools menu of Internet Explorer. We always recommend the use of fully up-to-date third-party anti-virus, firewall and Internet security software, particularly for Microsoft Windows users.

Again, I would like to be clear that we fully recognise the impact this will have on our customers and indeed the internet community in general. All of us here are taking this week’s security breach extremely seriously and we are doing everything possible to resolve all outstanding issues. We will be publishing a full incident report and plan on what we intend to do next to our website before the weekend. This will explain exactly what has happened and how.

As you might imagine at this time, our Customer Support Team is extremely busy. I would be most grateful if, during the next few days, you could avoid contacting us unless you have an urgent issue that is not answered by any of the FAQs or elsewhere on our website. You can also find more details on our recorded information line 020 7517 8754 (please note that our Customer Support team are not available on this number).

Kind Regards,

Phil Webb
Networks Director
PlusNet

This email has been sent as it contains important information about your service from PlusNet. Please do not reply to this email, as this is an unmonitored address.

PlusNet plc
Registered Office: Internet House, 2 Tenter Street, Sheffield, S1 4BY
Registered in England no: 3279013

The article reffered to on the staus page:

Service Status RSS Feeds
Reports of Spam Email (42837) - UPDATE
Email
Posted on: Tuesday 15 May 2007, 15:44
This is an update to the previously reported issue regarding the increased volume of unsolicited email being sent to some customers' mailboxes. A copy of the last update can be seen here:-
http://usertools.plus.net/status/archive/1179167580.htm

We are currently dealing with a serious security incident that has resulted in a third party illegally accessing our Webmail database. The third party has acquired a list of email addresses for the purpose of distributing unsolicited email (spam).

We take the security of our customers' information very seriously and would like to reassure customers that the incident is being handled with the utmost importance and that at this stage in the investigation we believe no other personal information, including credit card details, has been disclosed.

We would like to assure customers that our incident team are working around the clock with the relevant authorities in order to resolve the situation. We have conducted a full platform audit and our network and software engineers are currently taking a number of actions to minimise any further risks to customers.

We became aware of an attack on Wednesday 9th May 2007 and immediately took our Webmail service offline to secure the platform. We promptly identified the source of the vulnerability and implemented a fix to prevent further attacks. We will provide full details on the vulnerability and actions taken in the incident report which we aim to publish on Friday 18th May 2007. At present we are working with our vendors and legal authorities so cannot expand further on this.

As a result of the attack a small number of customers may have downloaded a Trojan virus. This will only have affected un-patched Windows PCs with no anti-virus software installed. We are contacting affected customers by phone and email. If you have not received an email from PlusNet customer support today regarding this, your PC is not affected. However we always recommend customers have fully up-to-date Windows software and anti-virus software.

On Sunday 13th May 2007 we received reports that customers were receiving spam emails to addresses that had not previously received spam. Following investigation of these reports it became apparent that a third party had illegally acquired a list of email addresses. This list was obtained from our Webmail platform and includes accounts that customers have used to login to Webmail, as well as some email addresses contained in customers' online address books, and addresses customers have sent to using our Webmail service. It is possible that your email address may have existed in the Webmail database even if you had not used the Webmail service yourself.

This list is now being used to distribute spam email which continues to be sent to customers, and it is likely that this will continue.

One of six @Mail servers was attacked and it is possible that customers connected to this server during the incident, may have had their login details observed. Purely as a precaution we advise customers to change their account password by visiting our website https://portal.plus.net/my.html?acti...e_password&s=0 Please note if you change your account password this will need to be updated in your router or modem as well as your browser and email software.

We would like to sincerely apologise for the inconvenience to our customers and thank you for your patience whilst we continue to investigate and resolve this incident.

Further details will follow as they become available and a full incident report will be published on Friday 18th May 2007. In the meantime we would like to ask that you avoid contacting our Customer Support Centre regarding this issue as no further information is available at this time, we will provide all information that we have via Service Status and emails to customers.

Kind Regards,

Phil Webb
Networks Director
PlusNet

I have raised the following complaint with them:

I can not find an adequate place to make this complaint so I am making it here.

Since your security failure I am receiving 20+ spam messages per day to my spam free email address.

You are responsible for this.

In order for me to rectify the situation to prevent the arrival of unsolicited email I was not previously receiving I will incur costs:

1) Purchase and registration of a new domain. My current main domain is xxx.yyy
2) Modification of DNS records (30 minutes)
3) Modification of my mail server for the new domain (2 hours)
4) Modification of my other domains to forward email to my new domain (30 minutes)
5) Emailing my contacts to inform them of my change of email address (3 hours)
6) Emailing the contacts of other users of the xxx.yyy domain to inform them of change of email address (3 hours)

I will also experience loss:

I will need to abandon the domain xxx.yyy which I have held for over 4 years and is significant to me since it is related to my home property name.

I would like you to make me a reasonable financial offer to cover my costs and compensate me for my loss following your failure to adequately secure my personal details

I expect to receive this offer within 10 working days of this complaint (no later than Monday 4th June 2007) which is a reasonable time to process this complaint.

Failure to do so may result in me taking legal advice, the cost of which I will consider to be a cost incurred as result of your failure to secure my personal details and my requirement to obtain reasonable recompense for this failure.

Regards,
XXX

Thoughts anyone?
May 17th, 2007, 02:53 PM
Computernerd22

Quote:

I have raised the following complaint with them:

I can not find an adequate place to make this complaint so I am making it here.

Since your security failure I am receiving 20+ spam messages per day to my spam free email address.

You are responsible for this.

In order for me to rectify the situation to prevent the arrival of unsolicited email I was not previously receiving I will incur costs:

1) Purchase and registration of a new domain. My current main domain is xxx.yyy
2) Modification of DNS records (30 minutes)
3) Modification of my mail server for the new domain (2 hours)
4) Modification of my other domains to forward email to my new domain (30 minutes)
5) Emailing my contacts to inform them of my change of email address (3 hours)
6) Emailing the contacts of other users of the xxx.yyy domain to inform them of change of email address (3 hours)

I will also experience loss:

I will need to abandon the domain xxx.yyy which I have held for over 4 years and is significant to me since it is related to my home property name.

I would like you to make me a reasonable financial offer to cover my costs and compensate me for my loss following your failure to adequately secure my personal details

I expect to receive this offer within 10 working days of this complaint (no later than Monday 4th June 2007) which is a reasonable time to process this complaint.

Failure to do so may result in me taking legal advice, the cost of which I will consider to be a cost incurred as result of your failure to secure my personal details and my requirement to obtain reasonable recompense for this failure.

Regards,
XXX

Thoughts anyone?

Nicely written & worded. You can tell your serious about this. I wonder whats going to happen?
May 17th, 2007, 05:21 PM
Moira

I received this email. To be honest, I didnt even know I had a plusnet email address - I briefly considered moving to Plusnet some years ago, but abandoned the idea. I certainly don't to my knowledge get mail to an account with them. If so, then it doesn't download to my inbox and I know nothing about any extra spam!
May 17th, 2007, 08:36 PM
Linen0ise

Better check your service agreement contract.
May 17th, 2007, 11:10 PM
Moira

Who, me?
May 18th, 2007, 10:44 AM
nihil

Hi Moira,

That seems very interesting to me. You were considering a move but never made it.........and that was some years ago?

OK, you are still on their database, but don't you see that they are not targeting existing and active customers............... this is a shotgun fired at their entire database. Those guys are running scared, so I wonder what they have not told us?

I seem to recall a certain building society getting fined £980,000 for a security breach............................

:cool::eek:
May 18th, 2007, 02:00 PM
Moira

Yeah like you say, they aren't targetting existing and active customers - as far as I know, I never had a plusnet email address. Very interesting ..... I was fairly surprised to receive that email.
May 18th, 2007, 03:13 PM
steve.milner

I've had reply basically saying my request is above the person's pay grade and it has been escalated

I was expecting an outright rejection.

Perhaps a 'class action' is worthwhile ;)

Steve
May 18th, 2007, 03:17 PM
steve.milner

Quote:

Originally Posted by Moira

I certainly don't to my knowledge get mail to an account with them. If so, then it doesn't download to my inbox and I know nothing about any extra spam!

I've neer used their webmail service, and don't use them for mail at all. I have my own server.

However when I signed up with them years ago I gave them (foolishly it now seems) my 'real' email address as a contact and It's that address, that was previously spam free which is getting the spam.

I agree with Ni, there's more to this than meets the eye!

Can anyone recommend a good UK ISP that offers a sensible priced (£20 or less) fixed IP ADSL service?

Yeah OK I'm filtering it out etc. but that's not the point. It's eating my bandwidth and since I'm on the end of a very long piece of wet string I only get 512K anyway so it's quite precious me.

I'm already got a new domain and I'm in the process of getting it sorted out.

DNS is done, and mail forwards are set up for my old domain.

I need a few new certificates and then I've my machine at home to change the hostname on and then everyone I know needs to be informed...

<sigh>

Steve
May 18th, 2007, 09:36 PM
Moira

Has anyone now had a second email? I won't quote it in full because it's quite lengthy, but it starts:

Quote:

From Thursday 24th May we will be making our Spam Protection service available to all customers, so even those who haven't been able to take advantage of the service up until now will be able to benefit from reduced levels of unsolicited and nuisance email.

Entitled Email Security Improvements it still seems to imply I have an account with them!
May 18th, 2007, 10:05 PM
steve.milner

Just got one Moira.

Are you paying them anything??

Steve
May 18th, 2007, 10:13 PM
Moira

Like hell am I paying them! What would I want to pay PlusNet for ?? They aren't my ISP.
May 18th, 2007, 10:40 PM
steve.milner

It's all a bit wierd really.

Steve
May 18th, 2007, 10:43 PM
Moira

Very. It makes me glad I'm not a PlusNet customer if this is an example of their efficiency. They certainly don't provide me with any service, nor do I pay them so it's rather strange to be the recipient of all these emails. When I was considering switching to them it was several years ago too.
May 19th, 2007, 12:07 AM
nihil

OK I have been giving this one a bit more thought and have the following suggestion. It is pure speculation on my part but seems to fit what we know so far?

1. PlusNet obviously have a contacts database of everyone who has ever contacted them for any reason. We all know how anally retentive marketing types can be when they get a "live" e-mail addy? :D This would explain why Moira is getting the warnings even though she never did business with them.

2. I would suspect that the contacts database is not considered important and has been compromised in its entirety. I would expect that the customer accounts database is secure or at least relatively so. If it had been compromised, Steve would get the e-mail but Moira wouldn't.

Basically PlusNet have been holding personal details of people who are not their customers. I know that this is done whilst you are negotiating with a potential customer, but I would have thought that it was common practice to delete these records after 6 months or so.

This raises a couple of questions in my mind:

1. What are PlusNet going to do for people like Moira, who has been compromised by their incompetence but is not a user of their services?

2. What other personal information was on that database and has also been compromised? :eek:

EDIT: The plot thickens::D

http://www.theregister.co.uk/2007/05..._webmail_shut/
May 19th, 2007, 10:54 AM
Moira

Quote:

Originally Posted by nihil

2. I would suspect that the contacts database is not considered important and has been compromised in its entirety. I would expect that the customer accounts database is secure or at least relatively so. If it had been compromised, Steve would get the e-mail but Moira wouldn't.

Or else we'd both get an email if both databases had been compromised.

Quote:

Basically PlusNet have been holding personal details of people who are not their customers. I know that this is done whilst you are negotiating with a potential customer, but I would have thought that it was common practice to delete these records after 6 months or so.

Quite. It was so long ago that I contacted PlusNet that I'm concerned they still hold my details. It makes you realise just what information is held about you by various organisations and the idea that this is deleted when it no longer serves a purpose, clearly isn't being done at all.

Quote:

1. What are PlusNet going to do for people like Moira, who has been compromised by their incompetence but is not a user of their services?

Well, they say I've been compromised, but I'm hard pushed to see any damage tbh. I'd like to think I could demand financial compensation but I don't think I've probably got much of a case!

Anyway, I'll wait and see what transpires. They may be forced into compensating people with enough pressure.
May 19th, 2007, 11:24 AM
nihil

I don't think that the customer account database has been compromised, as they would have to warn people about that, given that it would contain credit card and banking details.

You will probably OK as I would expect spammers to check the record dates and delete old ones. Obsolete spam lists are of no value?
May 19th, 2007, 11:32 AM
Moira

Well since to my knowledge I don't even have a PlusNet email account, it follows that it can't be receiving spam. Either way, I haven't been receiving spam to anything but my normal accounts (Yahoo and Gmail attract spam like a magnet!)
May 19th, 2007, 04:41 PM
nihil

Hi Moira,

They are sending you e-mails, so that is the account that is on their database and has been compromised.

I presume that it is their marketing mailing database that has been compromised. I guess that will contain all existing customers, past customers and contacts such as yourself.

:(
May 19th, 2007, 05:52 PM
Moira

Yes ..... I'm just surprised they think I ever had a PlusNet email address, that's all, since I never actually got round to signing up with them.
May 21st, 2007, 12:51 PM
steve.milner

Quote:

Originally Posted by nihil

Hi Moira,

They are sending you e-mails, so that is the account that is on their database and has been compromised.

I presume that it is their marketing mailing database that has been compromised. I guess that will contain all existing customers, past customers and contacts such as yourself.

:(

And of course the natural place for a marketing database to sit is on your webmail servers !!

And yet all my card details and bank accounts are safe !!!

Steve
May 21st, 2007, 04:44 PM
nihil

Steve, my man in ***** Ah! the joys of censorship, that is L-a-g-o-s assures me that they are ;)

The point is that this heap of crap is owned by BT, our major telco and ISP player, who must have internal audit and security functions...................so what kind of order is their house in?

:eek:.
May 21st, 2007, 06:58 PM
Moira

More comment on this from thinkbroadband.com
May 24th, 2007, 09:52 AM
steve.milner

I have received an answer:

The following comment was added to the Question
Dear Mr xxxx,
Thank you for your enquiry. As neither ADSL or the email services we provide carry a service level agreement we cannot offer compensation for the issues you have experienced. Our wholesale provider doesn't even offer us a SLA on any products supplied, even for business customers. This means we cannot supply one in turn as it would be impossible to fulfill. The same can be said for email. Due to the nature of the service, nothing can be guaranteed. I know not of a provider in the UK who will guarantee an email service and offer financial compensation should emails be lost or otherwise. Once again, please allow me to express our most sincere apologies.

As you can imagine, this is not the response I was hoping for. I have, for the moment decided to follow the plus.net procedure for complaint resolution and I have writted to the customer service director, registered post, with a certificate of posting:

Dear Sir/Madam

I am writing because I have been unable to resolve the complaint I made to customer services: ID: xxxxxxxx for account xxxxxxxx to my satisfaction.

The basis is for my complaint is that as a result of your failure to secure my personal details, I am now receiving unsolicted (spam) email to my domain (xxxxxx.net) that was free of unsolicted email (spam) before this failure. As a result I have incurred cost and experienced loss to ensuring that I receive no spam, hence it is reasonable for these costs and losses to be recompensed.

Concerning the matters of service level agreements raised in the last reply to this ticket:

<snip above reply>

I consider that these matters are not relevant as I am not basing my complaint on a failure of service but of your failure to to take reasonable care to protect my personal details, and hence my claim is based on the premise that you have been negligent in securing my personal details.

I would therefore ask that you re-examine this issue and make me a reasonable financial offer to cover my costs and compensate me for my loss following your failure to adequately secure my personal details.

To break down my costs and losses further:

<snip details of costs>

I expect a reply within 10 working days of the posting date of this letter, no later than 10th June 2007

I enclose a copy of the ticket transcript.

Regards,
May 24th, 2007, 10:29 AM
nihil

Hmmm.............. hey Steve, do you want to borrow a box of coloured pencils (I used to use them for debugging program logic back then:D) because I think that you are going to have to spell it out to them in brightly coloured capital letters?

SLA = Service Level Agreement = "a contractual or quasi-contractual understanding between parties where a service is provided"

Regulatory Compliance = "conforming with the statutory regulations laid down by the Parliament of the United Kingdom. This includes, but is not restricted to the Data Protection Act 1984"

:D
May 24th, 2007, 01:07 PM
steve.milner

It will be interesting.

My Sister and my Parents are both plus.net customers and are awaiting the outcome of my complaint before starting their own.

They have released a 'detailed' report.

http://community.plus.net/comms/2007...cident-report/

I think this is relevant:

c. Why did it happen?

A vulnerability within our implementation of Webmail code in our portal was discovered and used by malicious attackers.

Our subsequent investigations found a number of vulnerabilities with our implementation of the Atmail application, including the vulnerability which had been exploited. This led to the decision we took to stop using the software entirely.

and this:
f. What have we done to resolve the problem and prevent something similar in the future?

Since the issue came to light the entire team at PlusNet has focused on the security of our network and customer data, and email system improvements. In order to resolve the issue and limit the impact on our customers we have:

- Undertaken a complete external security audit and rebuilt aspects of our platform that we felt didn’t meet stringent security best practices

- Created a dedicated PlusNet security team which is formally responsible for all aspects of data and software security on our platform

I consider that the above two points would have been expected to have been in place by a reasonable person.

As you said Ni, we should worry about BT!

Steve
May 28th, 2007, 09:34 PM
steve.milner

Update:

Quote:

Hmmm.............. hey Steve, do you want to borrow a box of coloured pencils

I think I'm gonna need 'em

The Customer Services Director has refused my claim, again quoting SLAs

I have requested a CISAS deadlock ID.

I await.

Steve
May 28th, 2007, 10:56 PM
nihil

Hmmm, the scumnet crowd seem to like to blame their "wholesaler"............. that does not cut ice............ could be close to fraud? as their "wholesaler" happens to own them? maybe sue BT direct for the actions of their subsidiaries whose actions they are clearly responsible for?

Perhaps it is time your MP asked a question in the House other than directions to the nearest toilet or bar?

BT must have some sort of licence, maybe it is time that it was challenged?

;)
May 29th, 2007, 02:32 AM
Net2Infinity

Well Steve, even though I am sympathetic to your situation I am failing to see how you have a claim against them just because you now receive spam. Sure you can claim you didn't receive spam before the breech, but can you prove that the spam is a direct result of the breech? Heck, perhaps you were in someones address book and it got rooted by a virus. Thus you are now receiving spam and its a mere coincidence. I am not sure of the other laws in the UK pertaining to this matter as I reside in the United States, however you have to prove there wasnt another vector for a spammer to get your address.
May 29th, 2007, 08:54 AM
nihil

Net2Infinity,

Quote:

but can you prove that the spam is a direct result of the breech?

There isn't any need, as Plus Net have admitted that a breach in their security has resulted in people on their records receiving spam. They have actually e-mailed people warning them of this problem.

Quote:

perhaps you were in someones address book and it got rooted by a virus.

Along with a lot of other Plus Net customers who have never even heard of Steve, nor he of them? The only address book would have to be Plus Net's;)

They are not denying what has happened, nor that it was their fault. The issue here is to what extent might they be held financially responsible.

In the case of private individuals I would say that the losses/costs that you could prove would be so small as to not make it worthwhile. In the case of websites and commercial customers, it is a different matter.

As Plus Net have not immediately responded by quoting some "small print" that absolves them of blame, I suspect that there isn't any. Their lawyers (and other reptiles) will have advised them to be in a state of denial, at least until they can figure out the potential scope of the liability ;)
May 30th, 2007, 12:12 PM
steve.milner

Plusnet have quoted their contract:

Quote:

22.2 We have no liability (whether in negligence or otherwise) for any loss not reasonably foreseeable by us when this Contract starts, nor any loss of opportunity, goodwill, reputation, business, revenue, profit, or savings you expected to make, wasted expenditure, data being lost or corrupted, loss or damage incurred by you as a result of third party claims or any indirect, special or consequential loss or damage howsoever caused.

I beleive my losses and costs could be reasonably forseen at the time of entering into the contract:

I believe it reasonable for Plusnet to foresee that, at the time of making the contract that:
1) Customers using their service will register domains with companies other than Plusnet and use those domains for the purpose of email.
2) Customers who need to change their domain(s) will incur cost and experience loss.
3) To prevent unsolicited email from arriving at a domain will require the domain to be changed.

This is all with CISAS right now.

Interestingly enough Plusnet Customer Services refused to give me my CISAS ID claiming I'd have to wait three months (as per CISAS guidelines) until I asked how the situation was going to change over the next three months and then they relented.

I agree Ni, it's not big bucks I'm asking for, but I still think I should be able to cover my costs fixing this, and then of course there's the matter of my beloved domain I will have to loose <sob!>

Steve
May 31st, 2007, 03:21 PM
steve.milner

It just gets better...

I was perstering Plusnet for a CISAS deadlock ID and got this in reply:

Quote:

Dear Mr xxxxxx,
No compensation will be offered in this circumstance.

Your ID is as follows: 513497

Regards,
Mxxx Pxxxxx

It turns out this is not a CISAS deadlock ID, but something else.

Now I wonder, has my persistance got under someone's skin and they have just replied with a random number, or is this part of Plusnet way of preventing me getting a CISAS ruling on this matter.

Just plain shoddy either way.

I've asked for the purpoose of that reply to be explained to me.

I now have a proper deadlock ID

Steve
May 31st, 2007, 07:39 PM
nihil

Hi Steve,

Quote:

Interestingly enough Plusnet Customer Services refused to give me my CISAS ID claiming I'd have to wait three months (as per CISAS guidelines)

For a brain dead customer service type, they seem to know rather a lot about the small print? I wonder why?:rolleyes:

Quote:

Your ID is as follows: 513497

Only half a million complaints this week............ and it looks like you are at the bottom end of the food chain mate! :D

Seriously, perhaps the time has come to involve the forces of darkness.

1. They have obviously allowed your personal data to be compromised.
2. They are obviously anally retentive when it comes to personal data (remember that they could still contact Moira after all that time?)
3. I am pretty sure that they would not survive a serious Data Protection Act audit:lildevil:

As one squirrel said to the other squirrel: "go for the nuts mate"
June 1st, 2007, 11:12 AM
steve.milner

I'm in communication with another similar minded Plusnet customer who is persuing the DPA route.

It seems likely that this will yield results, since there is no requirement for them to hold my email address on their webmail server as I dont use the service.

Whichever route proves to be the most useful will be adopted.

And then we'll publish the route to all their customers so that others may persue their losses.
June 2nd, 2007, 11:16 AM
nihil

Hi Steve,

Please keep us informed. I know that it is of relatively limited interest given that this is a UK company trading under UK corporate, contract, consumer, and data protection laws. But it does raise the issue of "what would happen to me if it were in my country?"

In the past, PlusNet have always tried to weasel out by blaming their "wholesaler", but now that they are owned by BT (our largest Telco and ISP, for our overseas readers:)) they cannot use that excuse anymore?

They are a wholly owned subsidiary, so "arms length trading" is no longer a legal option for them ;)

You won't get any money from them, but they might offer you some free months service :shocked: as that is only a marginal cost, and would not have so great an impact on their bottom line. If you think about it, the infrastructure is set up, your account is set up, and their ongoing maintenance costs of that account must be minimal?

Good luck mate!