Sam Disraelly, his wife and their 2 girls have been Westport residents for 7 years. A Navy veteran, he is on the board of the Westport Weston Chamber of Commerce. He is also a founder and CEO of Your Tech Department, a cybersecurity and IT support firm with offices in Wilton, Stamford and Westport.
Sam addresses this warning to “every neighbor still using an optonline.net email address.”
If you signed up for Optimum internet more than 5 years ago, there’s a good chance you got a free email address along with it — something ending in @optonline.net or @optimum.net.
If you’ve had it a while, you might still be using it. A lot of Westport and Fairfield County residents still are. They’re familiar. They work.
And that’s exactly the problem.
Sam Disraelly
I run a cybersecurity and IT support company in Fairfield County. People call me all the time after their optonline.net or optimum.net email gets hacked. Of everything I see in this business, it’s the one service that generates the most calls of this kind.
Three things are considered baseline in 2026 for any email provider:
Two-factor / multi-factor authentication (MFA). This is a second proof of identity beyond your password — an SMS code, an app confirmation — before anyone can log in. Microsoft’s research shows MFA blocks more than 99.2% of account compromise attempts, even when a password has already been stolen. It’s become standard on nearly every major email provider.
Session logs. The ability to see where and when your account has been accessed, so if something looks wrong (a login from a country you’ve never visited) you’d actually know.
The ability to kill an active session. If you discover you’ve been breached, the ability to remotely log out every open connection to your account.
None of these exist in Optimum’s email settings. There’s nothing to configure, because the option was never built.
Optimum notes the importance of 2-factor authentication (above). However, they do not offer it.
Changing your password isn’t enough, either.
If you call Optimum and say you think your email’s been compromised, the advice you’ll get is to change your password. What they won’t tell you — because there’s no way for them to check — is whether that actually locks the hacker out.
Without session logs or the ability to end an active session, an account that’s already open in a hacker’s session before the password change simply stays open. A new password doesn’t close an existing connection; it only stops new logins. The old session keeps receiving mail as if nothing happened.
So a compromised Optimum account can stay compromised indefinitely, silently, even after you think you’ve fixed it.
An email address isn’t just an address. It’s the recovery point for your bank, your medical portal, your retirement accounts, your kids’ school logins — nearly everything password-protected online gets reset through email. If someone controls your inbox undetected, they control the keys to reset almost anything else you own.
Why hasn’t this been fixed? Because Optimum has quietly stopped investing in this service.
Buried in Optimum’s FAQ, under a page titled “How do I check my Optimum email?”, is this: “As of May 4, 2021, Optimum no longer offers the ability for new and existing Internet customers to create new Optimum email accounts.”
This means Optimum won’t create new addresses for anyone. It’s not an announcement of a shutdown, and existing accounts still work.
But Optimum’s own residential Terms of Service go further: any email account inactive for 90 days — no login, no sent or opened mail, no active forwarding — is deemed inactive and permanently deleted, contents unrecoverable, with no obligation to notify you first.
Screenshot of Optimum’s Terms of Service.
An address you’ve had for 15 or 20 years, tied to accounts you may have forgotten about, can simply vanish if you go 3 months without opening it.
Taken together: no new accounts issued since 2021, no security features added since who knows when, and inactive accounts wiped without warning. It’s a strong signal about where Optimum’s investment in this “free feature” has gone.
You don’t have to wait for Optimum to fix this, because there’s no sign they’re going to.
Instead: Set up another email address. I recommend buying a domain. Use it to host your own email on a trusted service, so you can control your own digital identity. If you need to use a free account, there are other providers like Gmail, Outlook, or a similar provider that supports MFA, session logs and remote sign-out.
Forward your Optimum mail there in the meantime, or notify your important accounts (bank, medical, etc.) of the new address or switch them over directly.
If you’re not sure how, ask someone: a neighbor, a local IT person, your kid. This isn’t a hard switch, just an overdue one.
I’ve started gathering stories from people in the area whose Optimum.net or Optonline.net email has been hacked or compromised, as part of a push to get Optimum to bring their email security up to a basic 2026 standard. If that’s happened to you and you’re willing to share what happened, I’d like to hear from you. My email is sam@yourtech.team.
This isn’t about switching internet providers. It’s about one free feature that’s been quietly neglected for 5 years while sitting at the center of — and now endangering — a lot of digital lives.
(“06880” wants our readers to be safe. We want them to be informed. And, every once in a while, we want them to show support for this hyper-local blog. Please click here. And thank you!)
Meanwhile Optimum floods the airwaves with its ads to turn to them for better service.
Your warnings appreciated
For my business clients, we still like their business class internet service. We’ve used them for over 20 years. We don’t use their phone services or mobile services, and these days we recommend streaming services over their TV.
I don’t like their marketing or pricing practices. But we have pre-negotiated rates in order to get our clients off what I call the promotion price roller coaster. That at least makes the relationship manager… But even with that relationship, I’m still frustrated by seeing my neighbors fall victim to the problems Optimum is causing every day. That’s why I wrote the piece. Thanks for your comment Robert.
Recently I received almost daily warnings that my optonline.net address was on the dark web. I am phasing it out, moving to Gmail.
That’s a good call!
Happened to me on my Optimum address (which was already my tertiary one, thank goodness): Someone was using my address to send spam everywhere, and my inbox was loaded with bouncebacks and hate mail. Thousands and thousands of emails. I’m persistent and was able to get it stopped, but it took months.
I’m so sorry it happened it you. We hear this story a lot, and it just happened again to someone else this last week which I why I wrote this piece for Dan, to get people to change before it happens to them.
I’m putting a litst of people together for more advocacy work, would you be willing to share your story? can I connect and add your name to the list?
Great information. Thanks Sam!
I noticed both the lack of appropriate controls in my optimum emails, and the propensity to get hacked. I moved my accounts to a different email, which took time, before I shut down the Optimum accounts, and finally left Optimum altogether.
My question for Sam is this: with your own domain, how do you keep that safe from hackers? Doesn’t Gmail or Yahoo have better security than I would be able to provide?
Oh no, absolutely not…
When you buy your own domain, you get to pick where you host your services… Where you host the website, and where you host the email. (and if something happens, you can take the email someplace else, something you can never do on free emails.)
Many domain registrants have email hosting options, and most will have decent security, but as a policy, I tend to say, “don’t put all your eggs in one basket.” (even though it may be slightly easier for the everyday person).
We actually recommend Microsoft’s 365 cloud services, for businesses and individuals alike. Corporate security is the standard for all out clients. If you love Google, you can pay Google to host the email from your domain through the Google Workspace program as well.
Both Google and Microsoft meet the standard I laid out above… 2 Factor Authentication/Multi Factor Authentication, the ability to see who is logged in, and kick them out. So we tend to point people in these directions.
If you want to chat more, feel free to reach out:
https://yourtech.team/connect/sam
Quite apart from the ISP’s competence in email hosting, IMHO it’s a poor idea to use the same provider for multiple services. In this example, changing from one ISP to another means the inconvenience of changing email address. Unlike years past, we’re also now blessed with some level of ISP competition (Optimum, Frontier, Xfinity for hardwire, TMO, VZW for “wireless home internet” (essentially a house-wide WiFi hotspot).
ISP “Bundling” (Internet, TV, mobile, landline (VOIP)) is designed to make it very very inconvenient to switch.
I totally agree with you Ken…
We haven’t really ever recommend Optimum Voice services.
And for TV… we tend to recommend streaming as well.
But here’s the difference…
Federal law says you can take that phone number somewhere else, even if you got it from Optimum 20 years ago, and you don’t have to leave that phone number behind. It’s a pain for a few days, but it’s not a lock.
That’s not the case with an ISP generated email address. That’s why we recommend owning your own domain for email purposes. You will never again be tied to a provider without that same portability you can have with Phone services.
In the piece, I mainly attribute people staying with Optimum’s email as momentum… but you’re absolutely right, there is a practical aspect… I’ve railed against Optimum and their failure to meet these critical standards for years. I’ve often said, “Why don’t they just shut it down if they aren’t going to support it?” If they did that, then at least these customers would be forced to find safer email.
Maybe you’ve touched on the answer… For some of their users, it’s a significant reason they haven’t switched away from Optimum. That email, unsupported and unsafe as it is, is keeping them with Optimum, and if Optimum shut the service down, they would lose that lock, and maybe finally lose that customer. Ultimately, that’s why I wrote the piece. If people know how unsafe it is, maybe they will choose to move themselves, like Stacy and Franco in the comments above.
I regularly advise people to NOT use an email provided by the vendor of another service, such as an Internet provider (Altice/Optimum, Frontier, Xfinity, etc) for the simple reason that if/when you change providers, your email will go away, too. The same with putting your personal activities on a work email address. When someone leaves the company, they no longer have access to their former employer’s email account.
Email providers such as Google (Gmail) and Microsoft offer both free and paid email offerings.
For those who want to have their own domain (myowndomain.com, for example), there are many companies that offer email hosting with your own domain. Google and Microsoft are two of the biggies, but companies such as hostinger.com can be attractive. However, once you own your own domain, much of the management of that falls on you and requires not only some time and attention, but at least a little bit of technical skills to set up and manage.
Most people do well with free email accounts from Google (Gmail) or Microsoft (outlook.com, Hotmail.com, live.com) because they provide a very attractive combination of features, security and price (free).
Mark, thanks for posting!
I totally agree with you, and a great analogy point!
You can’t take a work email with you if you leave a company, so always keep a personal one and never do personal services on a work email… HUGE!
With corporate providers, like Microsoft and Google, they open up their platform to secondary service providers… so more advanced services can be layered in, like cloud backup or secondary spam and malware filtering. That’s a big reason why we stick with them, even for individual/consumer/family domains. And after setup, there’s usually not TOO much maintenance.
We only charge an hour or two for that first time setup… and have had clients on those services for years.
Thanks for this, Sam. I’ve forwarded this to my friends who use OOL. I am happy with gmail. My employer uses outlook and there are always problems and hacks.
Sue, thanks for commenting.
For a free service, GMail isn’t terrible for personal use, unless you mind the loss of privacy.
I always tell my clients, if you’re not paying, you’re not the client… you’re the product. That’s an important fact so many of us forget or ignore.
With free email, there are always trade-offs.
As far as what is going on with your employer…
Microsoft 365 is one of the more secure paid platforms right now, and the access they can offer internal IT departments or companies like mine, to collect and monitor security data and lock down environments, is definitely one of the better cloud based systems out there.
If there are always problem or hacks, it sounds like there may be something else going on. Real Estate email services are always under attack, since you’re always dealing with so much money and personal data. I’m sure they have a great team… but if they need a hand, have them reach out.
Sam,
What are your thoughts on the value of obtaining a VPN?
Thanks to you and Dan for elevating this to a rational discussion.
Eric,
Thanks for the question.
A VPN can be an indispensable tool in the business and security arena, when used properly. Unfortunately, we’ve recently fallen into a trap of Marketing “Buzz-Word-Bingo” and services are selling it as a panacea or cure-all. I mean, who doesn’t love a good acronym?
The three questions are…
What are you using it for?
Where does your VPN connect to?
Who is providing it?
Good uses for a VPN include:
Connecting to your secure network in your office (or home).
Protecting your traffic when using public access wifi’s like coffee shops or hotels. (Hackers love these places.)
You don’t need a VPN when inside your home network too much… Some people may disagree with me about this. But I tend to believe there’s only so many things you can worry about. And right now, my opinion of Optimum isn’t high enough to think they could handle monitoring every single one of their client’s web traffic in order to monetize it.
And if you’re looking for simply an anonymizing VPN,
it matters which one you choose.
One “Tech Transparency” report found roughly 1 in 5 of the top 100 free VPN apps on Apple’s US App Store are secretly owned by Chinese companies, across more than 70 million downloads. Especially “FREE” VPN’s…
I’ve said it before and I’ll say it again…
If you’re not paying, you’re not the client, you’re the product.
Sam,
Thanks much. Really helped put things in perspective.
Anytime!