Hacked Account

[Den1s]

Hi, I was recently hacked and a number of calls were made by a rogue caller and ramped up quite a bill. Having looked in my logs I have the following information. How can I prevent these numbers from being called? I dont understand what was done here, can someone please explain.

09/04/2019 13:12:54	000	19096104712	000	900447452010034	[19096104712]_000-900447452010034_20190409111254(61).wav
09/04/2019 13:12:46	000	19096104712	000	900447452010032	[19096104712]_000-900447452010032_20190409111246(59).wav
09/04/2019 13:12:42	000	19096104712	000	900447452010031	[19096104712]_000-900447452010031_20190409111242(58).wav
09/04/2019 12:36:10	000	19096104712	000	900447452010034	[19096104712]_000-900447452010034_20190409103610(55).wav
09/04/2019 12:36:03	000	19096104712	000	900447452010032	[19096104712]_000-900447452010032_20190409103603(54).wav
09/04/2019 12:35:57	000	19096104712	000	900447452010031	[19096104712]_000-900447452010031_20190409103557(53).wav
09/04/2019 12:34:32	000	19096104712	000	900442033477788	[19096104712]_000-900442033477788_20190409103432(51).wav

09/04/2019 09:30:59	000	19096104712---972597662175	000	900447452010034	[19096104712---972597662175]_000-900447452010034_20190409073059(45).wav
09/04/2019 09:30:19	000	19096104712---972597662175	000	900447452010032	[19096104712---972597662175]_000-900447452010032_20190409073019(39).wav
09/04/2019 09:30:11	000	19096104712---972597662175	000	900447452010031	[19096104712---972597662175]_000-900447452010031_20190409073011(37).wav
09/04/2019 09:10:31	000	19096104712---972597662175	000	900447452010032	[19096104712---972597662175]_000-900447452010032_20190409071031(33).wav
09/04/2019 09:10:28	000	19096104712---972597662175	000	900447452010031	[19096104712---972597662175]_000-900447452010031_20190409071028(32).wav
09/04/2019 09:10:10	000	19096104712---972597662175	000	900447452010034	[19096104712---972597662175]_000-900447452010034_20190409071010(31).wav
09/04/2019 09:10:05	000	19096104712---972597662175	000	900447873011004	[19096104712---972597662175]_000-900447873011004_20190409071005(30).wav
09/04/2019 09:10:00	000	19096104712---972597662175	000	900447873091022	[19096104712---972597662175]_000-900447873091022_20190409071000(29).wav
09/04/2019 09:09:04	000	19096104712---972597662175	000	900448009879077	[19096104712---972597662175]_000-900448009879077_20190409070904(23).wav

 

[craigreilly]

this alone does not tell us much.
this looks like a recording log maybe?
the activity log might have some more info.

in the 3cx extension list - are there any of these?


If so you need to change your credentials to something more difficult using the regenerate button.

 

[leejor]

You may have a few issues to deal with.
How did they get into 3CX? the Activity log should show where the calls originated.
Did they guess a password and register a set? Was this an "inside job"?
Are the numbers they called dial-able by anyone (extension), this can be limited in the outbound rules and should be done, in particular, for high value numbers. 3CX can also prevent calls to certain regions/countries not normally called. Very expensive calls (high value numbers) can usually be blocked by your provider as well.

 

[StefanW]

I suggest to follow all point int this guide

https://www.3cx.com/blog/voip-howto/call-fraud/