Unauthorised login to Evernote - Hacked?

[K Leung 0]

Hi - I received an email about a new login to my Evernote account this morning from the Philippines. I changed the Evernote password, enabled 2FA and revoked access of that device. It was obviously too late as I was aware of the email notification 5 hours since it was sent. 

I am wondering if there is a way to check what information was downloaded to the unknown device. I want to know what contents were stolen. Thanks for your help.

Evernote for Android Android -Android-SM-4218d	11/13/2020	210.185.171.10 (Manila, Philippines)
Evernote for Android Android -Android-SM-4218d	11/13/2020	120.29.70.142 (Pampanga, Philippines)
Evernote for Android Android -Android-SM-4218d	11/13/2020	27.77.223.161 (An Giang, Vietnam)

[Tnote 0]

Hi, I have the exact same question. Is there a way to know what content was downloaded?

Thanks

[PinkElephant 8,279]

AFAIK you can only ask support to pass this on to the EN security team. Maybe they can check the server logs.

[Fung 11 0]

Exactly the same here! So much other people login to my account too, I enabled "2 step login" but I never receive any sms when they login to my account, I don't even can check what device they use to login my account! 

Where can i find a evernote official support or it is time to leave evernote.

 

 

[Lalusi12 0]

Have you ever succeeded with getting information about what was downloaded?

[PinkElephant 8,279]

There is no information about what was downloaded (if any).

In access events some time ago EN security staff communicated the account was accessed, and then by the search function the hackers tried to find information about cryptocurrency wallets. When they didn’t find any, they left.

In general a hacker is after money, or what he can turn into it. An EN Account is usually not a good source for that. Who uses it to store sensitive information, plus using weak login credentials IMHO is sort of asking for trouble.

https://help.evernote.com/hc/en-us/articles/115004395487

[Kevmaj 0]

The way EN works, you should assume that ALL of your info was downloaded and/or saved. When you log in, it’s just a click to see any notebook or note and it loads it all - it wouldn’t take more than a min or two to copy/paste or even export/save some or all pages. It’s not like individual files that have to be retrieved individually. Assume it’s all been skimmed. I too got a notice some time ago; maybe 18 months ago now.