@hemaocai

On OVH's manager you can add secondary email addresses to a single account. I for example have three emails linked to my account. Upon logging in all those email addresses will get an email notifying me, AND upon doing a password reset all three email accounts will get the password reset link. At the first compromise which may have been external to OVH's systems the attacker may have added their email address to the list of valid emails, and may have received the password reset email at the other email address. This could explain why the second reset password email was unread...

0 reply

1 recast

1 reaction