General

I've received a number of emails from members stating they've received emails from my name that look very suspicious. These are spam or phishing, whatever you want to call them. THEY DID NOT COME FROM ME. Please ignore and delete them.

They came from a gmail address homestreet58. I don't know how this person got our email list or hacked into our website.

Please don't reply to any of these false emails, just delete them.

So you didn't get that Bitcoin I sent you, Kenn?

I guess that explains all the spelling mistakes...

Thought that email from Kenn today seemed a little phishy...

Not that it has anything do do with anything, but I also just got an email reporting reporting "2026 CMASS Officers Election" results earlier this evening.

So if we think the CMASS website may have been hacked, should we question the security of our recent CMASS election? I mean, how'd this "Kenn Blade (Incumbent)" fellow get so many votes?!? ;-)

(Half-kidding. Leaving it to the readers of this reply post to decide which half is the kidding part.)

On the upside though, today's torrential rains ought to be good news for the Oct 4th Amesbury launch going ahead, yes?

Thanks for taking time out from your busy schedule to address this, Kenn.

I answered the first email by asking what was up.

When I saw the words "gift vouchers" in the reply, it triggered my BS radar.

I pretty much knew it was a scam before seeing confirmation on your post.

The messages have been consigned to the spam pile.

Daniel, any rain at all can't hurt us but we could use more. Next week it's supposed to be much cooler and there's some tropical activity to keep an eye on.

Let's hope that things pan out for us by launch day.

Rick

Thanks for taking time out from your busy schedule to address this, Kenn.

When whoever sent the message mentioned "gift vouchers, it triggered my BS radar.

I've consigned the messages to the spam pile.

Another thing that raises my hackles is the use of the number 58, my birth year. But that's probably just a coincidence.

Daniel, any rain can't hurt us, but we still need more.

Next week is supposed to get cooler, though, and there's some tropical activity to keep an eye on. Hopefully that won't affect us come launch day.

Rick

Sorry about the repeat. I thought the first one didn't go through.

Seems to be a well known tactic. When I was working, would get similar emails supposedly from the head of the company. We would get periodic reminders that he would never ever ask for such a thing and not to fall for it. Interesting part for me is it seems to always happen when I am traveling and driving somewhere.

I spoke with ClubExpress this morning. There's been no breaches on the back-end, and I was told that this sort of scam happens to other clubs, typically when a member's credentials have leaked. I've been assured that no financial or authentication data is available to the scammer (or you, a valid member). Note that address, phone, email are optional member attributes.

For the moment, I'm assuming that a member's credentials have been compromised and I'll look into this a bit more. Assuming this is true, whoever's credentials were leaked might want to be on the lookout for other breaches and exploits of their personal data. It's possible that the attacker got in via the temporary password that CE generates and forwards to the new/renewing member, that the member never redeemed.

Login requires a password of a minimum strength of 10 characters - I'm evaluating whether we should diversify that (add requirement for special characters) and require a periodic password change. 2-factor auth is disabled.

Looks like another try at the well.

From moneyfish06@gmail.com. Seems to have a sense of humor given the email name.

Guy.

Sure why not? If this particular individual did successfully make a phishing attack/scam and was able to compromise a bank account, they'd be laughing all the way to (or from?) the bank.....