SECURITY ISSUE - has Avast been hacked?

Avast Free Antivirus / Premium Security
1

Today I received a convincing looking email (included below) that looks like it is from Avast notifying me that my account will be debited for my AV licence renewal, but if I have concerns, I can log in using a nice blue button. This is a phishing email and it is extremely well made. The real problem here is that it was addressed to my name, it was sent to an email address that is not public and is used merely as a forwarder and of course the sender correctly identified the kind of Avast software I have.
Sender could only have got the info from Avast. A hack
I emailed Avast abuse and received a standard automated reply, which did not address the issue but said:
Hello,
Thank you for the notification.
We have taken the appropriate action to block the offending user from using our service.
Regards,
Petr Chocholous
[it crowd]
AVAST Software
Budejovicka 1518/13a
140 00 Praha 4
Czech Republic

I had supplied the source code of the email and asked how could the sender know my personal details? The response does not address my question. When I emailed again asking for explanation, I received the exact same email again.
Because of the limit character limit on the forum post I was not able to include the source code of the email. I will try to post this in a reply to my post.

2

Below is the source code of the phishing email I received (I removed identifying info about me). I had to strip some of the code because of the maximum characters per post permitted on this forum.
From - Thu Feb 19 16:49:33 2015
X-Account-Key: account16
X-UIDL: UID16567-1385813624
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-path: service@nexway.com
Envelope-to: xxxx@ozweb.co
Delivery-date: Thu, 19 Feb 2015 14:43:05 +1100
Received: from mail-in1.xxxxxxx.net.au ([203.10.110.93]:35291)
by vmx12739.hosting24.com.au with esmtp (Exim 4.84)
(envelope-from service@nexway.com)
id 1YOI13-0004EG-Lg
for michael@ozweb.co; Thu, 19 Feb 2015 14:43:05 +1100
Received: from icp-osb-irony-in12.external.iinet.net.au (icp-osb-irony-in12.external.iinet.net.au [203.59.1.191])
by mail-in1.xxxxxxxxx.net.au (Postfix) with ESMTP id 7D7D5904419
for xxxxxxx@netspace.net.au; Thu, 19 Feb 2015 14:42:57 +1100 (EST)
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: REMOVED
X-IronPort-AV: E=Sophos;i=“5.09,606,1418054400”;
d=“scan’208,217”;a=“364817478”
X-Envelope-To: xxxxxxxxx@netspace.net.au
Received: from unknown (HELO gwprod.nexway.com) ([94.100.165.49])
by icp-osb-irony-in12.iinet.net.au with ESMTP; 19 Feb 2015 11:42:44 +0800
Received: from front3.telechargement.fr (unknown [10.100.33.103])
by gwprod.nexway.com (Postfix) with ESMTP id 71A781644A;
Thu, 19 Feb 2015 04:42:41 +0100 (CET)
Received: by front3.telechargement.fr (Postfix, from userid 33)
id F0FBC21A27; Thu, 19 Feb 2015 04:42:40 +0100 (CET)
To: xxxxxxxxx@netspace.net.au
MIME-Version: 1.0
Content-Type: text/html;
charset=utf-8
Content-Transfer-Encoding: quoted-printable
From: Avast Antivirus noreply@avast.com
Message-Id: 20150219034240.F0FBC21A27@front3.telechargement.fr
Date: Thu, 19 Feb 2015 04:42:40 +0100 (CET)
X-Antivirus: avast! (VPS 150218-2, 18/02/2015), Inbound message
X-Antivirus-Status: Clean

Avast reminder: Your subscription will automatically renew in 30 day= s REMOVED =20
<td height=3D"25" style=3D"font-size: 1px;“><!-- cell -=
→


<td align=3D"center” style=3D"text-align: center;“><tab=
le align=3D"center” bgcolor=3D"#F0F1F3" border=3D"0" cellpadding=3D"0" cell=
spacing=3D"0" width=3D"520">




<td height=3D"5” style=3D"font-size: 1px; border-=
top: 1px solid #C3CAD2;“> 





                    </tr>
                    <tr>
                      <td height=3D"5" style=3D"font-size: 1px;"><!-- c=

ell →


3D"Avast

<td height=3D"15” style=3D"font-size: 1px;"=

                        </tr>
                        <tr>
                            <td><p style=3D"text-align: left; margin: 0=

; padding: 0; font-family: Arial, Helvetica, sans-serif; font-size:14px; co=
lor:#4A585E; line-height: 160%;">In order to make sure that your license wi=
ll be extended before the expiration date, we will attempt to process a cha=
rge of 49.99=C2=A0AUD to the payment method on file on 08/03/2015. Your pro=
tection will only be extended until 21/03/2016 if we will be able to=
process this transaction successfully.

To review your purchase =
history or to cancel your Auto-Renewal Service, please login to your <a hre=
f=3D’%4’>secured Avast customer portal by following the instructions be=
low.



=20




<td height=3D"25" style=3D"font-size: 1px;“><!-- cell -=
→



<table align=3D"center” bgcolor=3D"#F0F1F3" border=3D"0" ce=
llpadding=3D"0" cellspacing=3D"0" width=3D"600">
<h2 style=3D"text-align: left; font-size:15px=
; color: #000000; font-family: Arial, Helvetica, sans-serif;“>Subscription=
Summary
<p style=3D"text-align: left; margin: 0; padd=
ing: 0; font-family: Arial, Helvetica, sans-serif; font-size:13px; color:#3=
03740; line-height: 160%;”> Order ID: 20629223

                        </p></td>
                    </tr>
                    <tr>
                      <td height=3D"15" style=3D"font-size: 1px;"><!-- =

cell →

<p style=3D"text-align: left; margin: 0; padd=
ing: 0; font-family: Arial, Helvetica, sans-serif; font-size:13px; color:#3=
03740; line-height: 160%;">Scheduled Transaction date: 08/03/2015</p=

<table align=3D"center" width=3D"525" border=3D"0" ce=
llpadding=3D"5" cellspacing=3D"0" bgcolor=3D"#F0F1F3" style=3D"background-c=
olor: #F0F1F3;“>

<td valign=3D"top” style=3D"text-align: left; fo=
nt-family: Arial, Helvetica, sans-serif; font-size:13px; color:#303740; lin=
e-height: 160%;">Product

                        Avast Pro Antivirus - Subscription
                       </td>
                      <td valign=3D"top" style=3D"text-align: center;  =

font-family: Arial, Helvetica, sans-serif; font-size:13px; color:#303740; =
line-height: 160%;">Quantity

                        1</td>
                      <td  valign=3D"top" style=3D"text-align: right;  =

font-family: Arial, Helvetica, sans-serif; font-size:13px; color:#303740; l=
ine-height: 160%;">Price

                     =20
                        49.99=C2=A0AUD
                   =20
                     </td>
                    </tr>
                    <tr>
                      <td colspan=3D"2" style=3D"text-align: left; font=

-family: Arial, Helvetica, sans-serif; font-size:13px; color:#303740; line-=
height: 160%;“>Total Price:
<td style=3D"text-align: right; font-family: Aria=
l, Helvetica, sans-serif; font-size:13px; color:#303740; line-height: 160%;=
“>49.99=C2=A0AUD




<td height=3D"15” style=3D"font-size: 1px;”><!-- cell -=
→ 

            <table align=3D"center" width=3D"520" cellspacing=3D"0" cel=

lpadding=3D"0" border=3D"0" bgcolor=3D"#FFFFFF" style=3D"background-color: =
#FFFFFF;“>

<td height=3D"15” style=3D"font-size: 1px;“><!-- cell -=
→


<p style=3D"text-align: left; margin: 0; padding: 0; =
font-family: Arial, Helvetica, sans-serif; font-size:14px; color:#4A585E; l=
ine-height: 160%;”>

              <tr>
                <td height=3D"0" style=3D"font-size: 1px;"><!-- cell --=

              </tr>
              <tr>
                <td height=3D"10" style=3D"font-size: 1px;"><!-- cell -=

→


<table align=3D"center" bgcolor=3D"#F0F1F3" border=3D"0" ce=
llpadding=3D"0" cellspacing=3D"0" width=3D"600">

<td height=3D"10" style=3D"font-size: 1px;“>


<p style=3D"text-align: left; margin: 0; padd=
ing: 0; font-family: Arial, Helvetica, sans-serif; font-size:13px; color:#4=
A585E; line-height: 160%;”>Login: hessenthaler@netspace.net.au

<=
/td>


<td height=3D"15" style=3D"font-size: 1px;“>


<p style=3D"text-align: left; margin: 0; padd=
ing: 0; font-family: Arial, Helvetica, sans-serif; font-size:13px; color:#4=
A585E; line-height: 160%;”>Password: zNJ7AfVy







<td height=3D"25" style=3D"font-size: 1px;“><!-- cell -=
→


=20
<table width=3D"520”>

<td height=3D"25" style=3D"font-size: 1px;“><!-- cell -=
→


<td align=3D"center” style=3D"text-align: center;">

                  <table align=3D"center" bgcolor=3D"#147CA3" border=3D=

“0” cellpadding=3D"0" cellspacing=3D"0" color=3D"#FFFFFF">

<td style=3D"margin: 0; padding: 1px;“><table bgc=
olor=3D”#019ECE" border=3D"0" cellpadding=3D"0" cellspacing=3D"0" style=3D"=
height: 40px;" width=3D"100%“>

<td align=3D"center” height=3D"40" style=3D=
“text-align: center; vertical-align: middle; height: 40px;color:#FFFFFF;” v=
align=3D"middle">
=20
=20
=20
<a target=3D"_blank" href=3D"https://avas=
t-au.nexway.com" style=3D"font-family: Arial, Helvetica, sans-serif; font-s=
ize:18px; color:#FFFFFF; text-decoration: none; margin: 0; padding: 10px 0p=
x 10px; white-space: nowrap;“>       &nb=
sp; Access Customer Portal      &=
nbsp;  







=20

<table align=3D"center” width=3D"520" cellspacing=3D"0" c=
ellpadding=3D"0" border=3D"0" bgcolor=3D"#FFFFFF" style=3D"background-color=
: #FFFFFF;“>

<td height=3D"20” style=3D"font-size: 1px;"><!-- cell -=
→ 

            <table align=3D"center" width=3D"520" cellspacing=3D"0" cel=

lpadding=3D"0" border=3D"0" bgcolor=3D"#FFFFFF" style=3D"background-color: =
#FFFFFF;“>

<td height=3D"25” style=3D"font-size: 1px;"> </td=

              </tr>
              <tr>
                <td align=3D"left" colspan=3D"2"><h2 style=3D"text-alig=

n: left; font-size:16px; color: #000000; font-family: Arial, Helvetica, sa=
ns-serif; line-height: 160%;“>Need additional assistance?


<td height=3D"5” style=3D"font-size: 1px; border-top: =
1px solid #C3CAD2;“> 


<td align=3D"left”><table width=3D"265" cellspacing=3D"=
0" cellpadding=3D"0" border=3D"0" bgcolor=3D"#FFFFFF" align=3D"left" style=
=3D"background-color: #FFFFFF;“>

<td width=3D"50”><img src=3D"http://images.telech=
argement.fr/img_mail_order_avast/supp.png" style=3D"display:block" alt=3D"“=
/>
<td valign=3D"middle” style=3D"vertical-align: mi=
ddle;“>
=20
=20
=20
<a target=3D”_blank" href=3D"https://avas=
t-au.nexway.com/contact.html?Langue=3Den_XW
" style=3D"font-size:14px; line-height: 200%; font-family: Arial, Helvetica=
, sans-serif;“>Contact Avast Customer Service




<td height=3D"30” style=3D"font-size:1px;" colspan=3D"2=
“> 


<table width=3D"520” cellspacing=3D"0" cellpadding=3D"0" bo=
rder=3D"0" bgcolor=3D"#FFFFFF" align=3D"center" style=3D"background-color: =
#FFFFFF;“>

<td align=3D"left”><p style=3D"text-align: left;margin:=
0;padding: 0;font-family: Arial,Helvetica,sans-serif; font-size: 14px; col=
or:#4A585E; line-height: 160%;“>Best regards,




<td height=3D"10” style=3D"font-size: 1.0px;" colspan=
=3D"2"> 


<td align=3D"left"><p style=3D"text-align: left;margin:=
0;padding: 0;font-family: Arial,Helvetica,sans-serif; font-size: 14px; col=
or:#4A585E; line-height: 160%;">Avast Software Customer Service Team

              </tr>
              <tr>
                <td height=3D"10" style=3D"font-size: 1.0px;" colspan=

=3D"2"> 


<td align=3D"left"><p style=3D"text-align: left;margin:=
0;padding: 0;font-family: Arial,Helvetica,sans-serif; font-size: 11px; col=
or:#4A585E; line-height: 120%;“>Please note: This email message was =
sent from a notification-only address that cannot accept incoming email. Pl=
ease do not reply to this message.




<td height=3D"30” style=3D"font-size: 1.0px;" colspan=
=3D"2"> 




<td align=3D"center"><table bgcolor=3D"#D7D8DA;" border=3D"0"=
cellpadding=3D"20" cellspacing=3D"0" style=3D"margin: 0; background-color:=
#D7D8DA;" width=3D"100%“>


<td align=3D"center”><p style=3D"margin: 0; padding: =
0; font-family: Arial, Helvetica, sans-serif; font-size:10px; color:#4A585E=
;">AVAST Software s.r.o., Trianon Office Building, Budejovicka 1518/13a, 14=
0 00, Prague 4, Czech Republic

3

Uh…did you think about saving via copy/paste into a text file then attaching the text file to your post?
It would make your post shorter.
I’m quite positive your computer has “notepad”.

4
Today I received a convincing looking email (included below) that looks like it is from Avast notifying me that my account will be debited for my AV licence renewal
Did you contacted avast about a refund (or anything else) ?
5

Yes, sorry I should have made an attachment.

I am not after a refund. The issue is that Avast does not seem to be interested. And more importantly, they are not saying anything about how someone could have got my name, the software version and non-public email address which I used to register with Avast.

I would think this is a serious issue, but they don’t. Mind you, the lack of comments to my post suggests no one is too worried about it.

cheers

M

6

I am not asking if you are after a refund or not.
I am asking if you have contacted avast about a refund or something else prior to receiving the mail.