From “You’ve Got Mail!” To “You Got Hacked!”: An Optimum Odyssey

I’ve been a Cablevision customer since the early 1980s, when they rolled out that new-fangled “cable TV” contraption.

A decade later they demonstrated another technological marvel — a cable modem, connecting to the internet — at Klein’s department store. I signed up on the spot, one of the first dozen or so here in Westport.

Whenever I had to call what is now Optimum support — not a lot, but more than I should have — I would tell the representative, “Look at my account. I’ve been a customer since before you were born.”

Invariably, he or she would remark — in a difficult-to-understand accent, over a bad connection (not the best look for a phone company) — “Thank you for being a loyal customer.” That’s the script, and they were sticking to it.

In August I posted an Opinion piece by Sam Disraelly: “Beware! Your Optonline Address May Not Be Safe!”

In it, the Westport cybersecurity expert warned that because Optonline had 3 known security flaws — including no 2- or multi-factor authentication — every user was at risk.

Sam noted: “An email address isn’t just an address. It’s the recovery point for your bank, your medical portal, your retirement accounts, your kids’ school logins — nearly everything password-protected online gets reset through email. If someone controls your inbox undetected, they control the keys to reset almost anything else you own.”

He advised: “Set up another email address. I recommend buying a domain. Use it to host your own email on a trusted service, so you can control your own digital identity.  If you need to use a free account, there are other providers like Gmail, Outlook, or a similar provider.”

Sam Disraelly

I edited Sam’s piece. I published it.

If only I’d acted on it.

I thought my long relationship with Optimum — filled with many minor hassles, but no major ones — made me immune.

Hubris, thy name is Dan.

Three Mondays ago, I could not log in to my email.

That’s happened before. I usually perform some variation of internet voodoo to get in.

This time: nothing.

I called tech support. The offshore representative with the bad connection advised changing my password.

I did. I got in. Some — but not all — of my email was there.

A few minutes later, I went to check it again. This time, I was again logged out.

I’ll spare you the 3 hours of back and forth with “tech support,” much of which consisted of variations of “change your password.”

I kept changing it. The intruder who had gotten into my account kept changing it back.

Suddenly I began getting strange notifications, from financial institutions and merchants I had relationships with, and those I did not.

Why was I getting messages from institutions I did not do business with?

When I called them to dispute changes to my account — or to deny I’d ever set up an account — they asked me for my email. I gave it to them.

Then they asked for my phone number and address.

Nope, they said. That’s not you.

The intruder was using my email — and his own (probably fake) identification. Everyone I spoke with thought I was the hacker.

Panicked, I did the only thing I could think of.

I called Sam Disraelly.

He talked me off the ledge. He explained exactly what had happened — and how he could fix it. He’s done this before; he knew all their tricks, and he had plenty of his own.

He communicated clearly. He did not make me feel like the idiot I was.

And — this is key — Sam is ex-military. He loves going after bad guys.

He took over my computer, remotely. Then he went to work.

Again, I will spare you the details. Suffice it to say, it was — exactly as Sam predicted — a 2-phase game: first cat-and-mouse, then whack-a-mole.

It took 8 to 10 hours a day, for several days, for me to convince customer service representatives — with hard-to-understand accents, on bad connections, unwilling to deviate from their scripts — that (to use one PayPal example), no, I did not just order hundreds of dollars of Instacart items in Phoenix.

Look at the IP address! Have I ever used Instacart? Have I ever done anything in Arizona?

“Well, sir, it is on your account …”

Throughout the ordeal, Sam Disraelly was there for me. He was a godsend. (One of the passwords I changed — before Sam got me to use a password manager, another thing I had stupidly never considered before — was “SamIsGod.”)

It’s been 3 weeks.

I’m 98% back to where I should have been before this whole cluster****. I haven’t had an odd notification in several days. (Knock wood — the intruder is probably still in my Optonline account, because they don’t seem to be able to kick him out.)

I started using 2 Gmail accounts I’d always had, but seldom checked. I’d always found Gmail confusing; now I’m a convert. An added bonus: Their spam filter is vastly better than Optimum’s. (Note my 2 email addresses: danwoog@gmail.com, and 06880blog@gmail.com.)

I’m using my password manager too.

And though 2- or multi-factor authentication — the “authorization code” sent to your phone or email — is a pain, it’s worth the hassle.

If Optimum had only sent me a notification asking if I’d requested a password change 3 weeks ago, all that could have been avoided.

For the entire time I was a customer, they did not offer that option — despite knowing how important it is.

Then Sam Disraelly wrote his Opinion piece for “06880.” And I got my identity stolen.

As of October 6, Optimum now offers multi-factor authentication.

Woo hoo.

(NOTE: You can contact Sam Disraelly directly here. To see an “06880” podcast featuring Sam, click here. Another superb tech wizard, who I’ve used often, is Jamie Berger Katz: 203-984-3834; jbkatz@gmail.com. Put both in your Contacts today!)

(Thankfully, we did not lose any “06880” funds to the intruder. But we still look forward to readers’ support. To make a tax-deductible contribution, click here. Thank you!)