Spike in attempted cyberattacks on healthcare sector

Sorry for butting in, and feel free to move, delete etc, as appropriate, But I do not know where else to post. Within 15 minutes this evening, I've been sent codes by Microsoft to reset my password 3 times. With the proviso that If I have not requested these codes, it's probably a mistake made by someone else, and no need to worry. But as Ernst Stavro Bloemfeld said in Goldfinger " " First time, Mr. Bond, its happenstance, 2nd time it's happenstance, but 3rd time Mr. Bond, its enemy action,"

Any advice would be welcome., Thanks.

Main piece of advice is, you need to make sure you have two step authentication on your important accounts. I tend to enable whenever available. Other part is ideally use a password manager to generate unique passwords. Recommendations would be onepass, keepass or bitwarden.(Avoid LastPass cause of poor rep) That's pretty much gonna keep you in a reasonably safe state. The attempt to reset indicates you probably weren't breached unless a suspicious ip logged in, could also be phishing mails.

Yes, you are dead right there, and I have 2 step verification on bank accounts, credit cards etc. bit of a pain at times, but it's definitely worth it. I don't really mind the occasional Microsoft " here is the code you requested", but when you get 3 of them in the space of 15 mins or so, that's what worries me a bit. Microsoft offers to remember your passwords, but I do not even trust that. I keep them in a safe password protected folder on the computer itself. Thanks for your help.

Yes, the MS email specifically states that if it was not you trying to reset your password, just to ignore it as it may have been an innocent attempt by someone with a similar account name to mine. And that has happened in the past, a single mail but when you get 3 of them in the space of 15 mins or so... As for someone deliberately trying to hack into my account (which is looking extremely likely, would you say? ) what's the best thing to do ? I've already set the password change interval to 60 days.

I wouldn't say it's extremely likely at all. I'd say any of the three possibilities I listed are as likely as each other. If you have a strong password that hasn't been used anywhere else, and MFA enabled, you don't need to do anything. For all you know, they've made a hundred thousand attempts to crack it, and are now spamming you with reset requests in the hope you change it to something that was in their list.

Oh, and regular password changes are not part of recommended guidelines any more. They're more likely to compromise security than enhance it. Set a strong, unique password, enable MFA, and then leave it alone

The change your password regularly has done an about turn so, because it was the universal mantra in the past, "change your password regularly" and the IT department of the organization I worked for at one time, it was mandatory on their computers. Thanks again for your helpfull advice, which I'll take.