I’ve been a Cablevision customer since the early 1980s, when they rolled out that new-fangled “cable TV” contraption.
A decade later they demonstrated another technological marvel — a cable modem, connecting to the internet — at Klein’s department store. I signed up on the spot, one of the first dozen or so here in Westport.
Whenever I had to call what is now Optimum support — not a lot, but more than I should have — I would tell the representative, “Look at my account. I’ve been a customer since before you were born.”
Invariably, he or she would remark — in a difficult-to-understand accent, over a bad connection (not the best look for a phone company) — “Thank you for being a loyal customer.” That’s the script, and they were sticking to it.
In August I posted an Opinion piece by Sam Disraelly: “Beware! Your Optonline Address May Not Be Safe!”
In it, the Westport cybersecurity expert warned that because Optonline had 3 known security flaws — including no 2- or multi-factor authentication — every user was at risk.
Sam noted: “An email address isn’t just an address. It’s the recovery point for your bank, your medical portal, your retirement accounts, your kids’ school logins — nearly everything password-protected online gets reset through email. If someone controls your inbox undetected, they control the keys to reset almost anything else you own.”
He advised: “Set up another email address. I recommend buying a domain. Use it to host your own email on a trusted service, so you can control your own digital identity. If you need to use a free account, there are other providers like Gmail, Outlook, or a similar provider.”
Sam Disraelly
I edited Sam’s piece. I published it.
If only I’d acted on it.
I thought my long relationship with Optimum — filled with many minor hassles, but no major ones — made me immune.
Hubris, thy name is Dan.
Three Mondays ago, I could not log in to my email.
That’s happened before. I usually perform some variation of internet voodoo to get in.
This time: nothing.
I called tech support. The offshore representative with the bad connection advised changing my password.
I did. I got in. Some — but not all — of my email was there.
A few minutes later, I went to check it again. This time, I was again logged out.
I’ll spare you the 3 hours of back and forth with “tech support,” much of which consisted of variations of “change your password.”
I kept changing it. The intruder who had gotten into my account kept changing it back.
Suddenly I began getting strange notifications, from financial institutions and merchants I had relationships with, and those I did not.
Why was I getting messages from institutions I did not do business with?
When I called them to dispute changes to my account — or to deny I’d ever set up an account — they asked me for my email. I gave it to them.
Then they asked for my phone number and address.
Nope, they said. That’s not you.
The intruder was using my email — and his own (probably fake) identification. Everyone I spoke with thought I was the hacker.
Panicked, I did the only thing I could think of.
I called Sam Disraelly.
He talked me off the ledge. He explained exactly what had happened — and how he could fix it. He’s done this before; he knew all their tricks, and he had plenty of his own.
He communicated clearly. He did not make me feel like the idiot I was.
And — this is key — Sam is ex-military. He loves going after bad guys.
He took over my computer, remotely. Then he went to work.
Again, I will spare you the details. Suffice it to say, it was — exactly as Sam predicted — a 2-phase game: first cat-and-mouse, then whack-a-mole.
It took 8 to 10 hours a day, for several days, for me to convince customer service representatives — with hard-to-understand accents, on bad connections, unwilling to deviate from their scripts — that (to use one PayPal example), no, I did not just order hundreds of dollars of Instacart items in Phoenix.
Look at the IP address! Have I ever used Instacart? Have I ever done anything in Arizona?
“Well, sir, it is on your account …”
Throughout the ordeal, Sam Disraelly was there for me. He was a godsend. (One of the passwords I changed — before Sam got me to use a password manager, another thing I had stupidly never considered before — was “SamIsGod.”)
It’s been 3 weeks.
I’m 98% back to where I should have been before this whole cluster****. I haven’t had an odd notification in several days. (Knock wood — the intruder is probably still in my Optonline account, because they don’t seem to be able to kick him out.)
I started using 2 Gmail accounts I’d always had, but seldom checked. I’d always found Gmail confusing; now I’m a convert. An added bonus: Their spam filter is vastly better than Optimum’s. (Note my 2 email addresses: danwoog@gmail.com, and 06880blog@gmail.com.)
I’m using my password manager too.
And though 2- or multi-factor authentication — the “authorization code” sent to your phone or email — is a pain, it’s worth the hassle.
If Optimum had only sent me a notification asking if I’d requested a password change 3 weeks ago, all that could have been avoided.
For the entire time I was a customer, they did not offer that option — despite knowing how important it is.
Then Sam Disraelly wrote his Opinion piece for “06880.” And I got my identity stolen.
As of October 6, Optimum now offers multi-factor authentication.
Woo hoo.
(NOTE: You can contact Sam Disraelly directly here. To see an “06880” podcast featuring Sam, click here. Another superb tech wizard, who I’ve used often, is Jamie Berger Katz: 203-984-3834; jbkatz@gmail.com. Put both in your Contacts today!)
(Thankfully, we did not lose any “06880” funds to the intruder. But we still look forward to readers’ support. To make a tax-deductible contribution, click here. Thank you!)