Hi @yearofthebeat, thanks for reaching out to the Sonos Community!
There are generally two ways this could happen - either a system transfer, as you performed on call with support, or manually changing the email address when logged in to the Sonos.com website.
I did take a look at the registration history of your system, and the account associated to your system didn’t change (until you transferred it through the app), so it looks like the email address linked to that account may have been manually changed via the Sonos website.
Is it possible that you left an open webpage while logged in to Sonos.com somewhere?
Hi @Xander P, thanks for your response. I don’t have any recollection of someone using my credentials to change the registration to this email I’ve never heard of, and I’m the only person who uses my laptop. I also live alone, so it’s extremely unlikely someone would’ve done this without my knowing. Given that, is it possible there’s a broader breach, and are you aware of this happening to other Sonos users?
If not, is there a way to see if anything suspicious has happened on my account, other than the registration being temporarily shifted to an email I don’t know? I went ahead and changed my password. Any other tips you’d offer to secure my account?
Thank you.
Hi @yearofthebeat
Apologies - Xander is on a long weekend off.
We are not aware of any such breach, no.
Do you tend to use the same password on separate accounts? If so, I recommend you visit this site and enter your email: https://haveibeenpwned.com/. If you are told that your email was involved in a breach, please change the passwords on all associated accounts, including Sonos.
It is difficult to see what someone could gain by re-registering your speakers, so seems unlikely that this is a malevolent action. It is not entirely unheard of for visitors to mess with Sonos registrations, though in these cases you are likely to recognise the email address (or it’s owner). This is now less common as we’ve introduced additional security in the app, and also due to Covid-19 lockdowns meaning there are less visitors in general.