Best Buy Store Purchase

[tolinger]

I purchased a laptop computer on 3/17/21, online, picked it up in Mission Valley SD store the same day.  It behaved clunky, I didn't like it and returned it the following day to the El Cajon Store the next morning.  The "Geek" named Tony told me to type in my password, which I had changed the night before as part of the setup process, so he could "wipe the data for resale". The rest of the return process was uneventful. On Friday March 26 at 10:30 AM my computer was invaded by somone from Nigeria who stole my entire contact list and used it to email everyone on it to send him gift cards.  God knows what other personal information was stolen. I'm not a computer expert so I immediately changed my password and that didn't work.  I hired a computer expert who knows alot more about Outlook. He found that the computer I returned and it's IP  was listed as a trusted device.  He told me it looks like the employee(s) at best buy are making a little extra cash selling customer personal data on the dark web.  This is an outragious breech of trust on the part of Best Buy.  The full damage this has caused me is yet to be determined. I went to the El Cajon store that evening to complain and the "manager", who was clearly not really a manager, copied my reciept and then told me that there was "no problem" and they did everything correctly. He gave me the Best buy customer telephone number where another very young person, again clearly not anyone in authority, told me that if I didn't like having my data stolen I should file a police report which I am considering because this has the potential to be a devistating loss.  I have proof the computer IP that I returned was the one used to hack my account.  Best Buy needs to install systems to protect customers from the theives they have working for them.   

[nckhammond]

Not saying it not possible they did this, however an 'IP' address is not tied to the computer. It's tied to a location. The IP address at your house would be completely different then the one at BestBuy. The IP address would give you a hint as to where it happened. It's also possible some installed malware did this after they turned it on at bestbuy. 'outlook' can be accessed anywhere and doesn't need a 'trusted device' to even be accessed, so it could even be completely unrelated.

[jdogg836]

Most of us can log in to our Microsoft accounts and see that there are various attempts from all over the world. This is even more true if the password had ever been breached. Mine gets tried 10 times a day from a breech way back in 2013. The password was changed a long time ago, so these attempts are futile. I’m also diligent on changing my passwords frequently to keep them guessing.

My recommendation, change your password to a strong NIST-compliant password, log out of everywhere and forget all trusted devices. Once you’ve done that, enable 2-factor using their authenticate or app.

I’m with nckhammond, it doesn’t seem like this would be related. The machine you purchased would have been wiped, and the account credentials no longer available to them. You may check your email on the haveibeenpwned website or equivalent, there have been medium to large sized breeches reported very recently that could explain your account breech.

[Meg-BBY Social Media Specialist]

Hello, tolinger,

Thank you for reaching out, and welcome to the Best Buy Forums. I'm sorry to hear that your new purchase of a laptop was not what you expected, and that you had to return it. Further, it sounds like your information has been compromised, and I know first hand that is not an ideal situation! 

We take ​Best Buy's Privacy Policy very seriously, and while I would be unable to speculate on what may have happened, jdogg836 has made some great points and future recommendations to keep your data and privacy safe. We do recommend changing all of your passwords and logging out of your accounts going forward.

Best,