A small digital death
I got hacked. On a good day too.
Last week, I was stupid in a very boring and predictable way. I’ll explain the full details and events during and after my little hacking misadventure, but first I want to explain just how good of a day off I almost had.
I wake up at a comfortable 6 am, enjoying a slower start after a few days in a row as the first baker where I set an alarm for 4:30 to catch the first train and head straight to work. I usually wake up by 4:15 knowing the alarm is coming. This Friday however I don’t have anything to anticipate. I wake up when it’s time.
First thing I do is chug water and eat some of the pumpkin cake I brought back from work on Wednesday. I had the end piece and it’s a few days old, so I spread some butter to add moisture. As I eat, I sit down at my computer, check emails, and confirm there is no immediate school work I need to prioritize. It’s the start of the “Fall Break” in my semester, so I have time to work on a few projects due in 10-15 days but nothing urgent.
Next, I open Steam. First up is something I can play on autopilot so I can listen to the end of my audiobook. I have one long chapter left in Player of Games, which I enjoyed while winning a run of Slay the Spire - Downfall. My run is great with cool combos and satisfying choices, but the real synergy is between my listening and playing where I slip into the classic Slay the Spire plus Audiobook flow state where just enough of my brain is occupied with simple but satisfying decisions on the screen and just enough is left over for entertaining and engaging words from the book. I finish the book and beat Act 3 around the same time and look for a new game.
Playing something short, artsy or creative on my day off is something I hope to make a habit. This time my pick is Sword of the Sea. I played about an hour on my last free morning, so I’m already familiar with it’s slick surf/snowboard controls and great vibes of zipping up and down snow, sand, and ash. There is a story, by far the most explicit narrative in the series of games made by studio Giant Squid1, but really its a mood game. The mood is doing sick flips off desert dunes with a magic sword surfboard and collecting coins. It’s a fun time.
The game rolled credits around 8:30 am, when Wesley was moving around and getting ready for their day. I’m looking for the next thing I want to do. The horizon is open. A quick search for movie times, and I grab a matinee seat for the remaster release of Satoshi Kon’s Perfect Blue. I haven’t seen it yet, but have been wanting to for a long time.
I have some time to kill before the movie, so I get to my serious work for the day: reading. I’m in the middle of a book of literary analysis by Robert Markey on the works of Kim Stanley Robinson (I know shocking!). The first chapter was a look into KSR’s alternate realities and had excellent sections of Shaman and the Years of Rice and Salt. The chapter I read between getting dressed and catching the train is on the Three California books, and I am already appreciating the threads Markey is drawing together between the alt history for the last chapter and alt futures for Orange County. It’s good stuff. Time to go, or risk being late. I will probably be ok even if the train is slow accounting for trailers before the movie. I’m not stressed.
It’s October in Boston, and the heat wave finally broke. Chilly weather is in and I’m getting all my moneys worth from the wool/possum fur sweater I spent my whole souvenir budget on in New Zealand. On Tuesday when I took a trip to the theater to see James Cameron’s Avatar 2 again, Mr. Cameron was wearing the exact same sweater as I was in his little welcome clip to viewers. Best item in my wardrobe for sure. It keeps me warm, even as Markey brings me to Mars. It’s colder than Boston, but warming fast thanks to the terraforming and eco-economics he covers in chapter 3. I’m highlighting up a storm in my new Kobo, nodding along about Sax and Ann, Greens and Reds, utopia as a survival strategy, and all that comes with change.
I arrive at the Common a few minutes before the ticket time, and into the theater with plenty of wiggle room to decide against concessions and find my seat. As a person who tries to be too cool and smart to mindlessly scroll on my phone, I try reading through a few of the previews before giving up trying to follow the words and watch the big pictures. The anime movie trailer pool is weak and nothing sticks out. Luckily, Perfect Blue plays soon and is fantastic. I leave the theaters debating if I want to iron out a top 5 anime movie list because this one probably just pushed an old favorite out. I didn’t make a list but the movie is great. If you have seen it you know why, if you haven’t I recommend it. The spiral around mistaken/stolen identity unfortunately will be fitting for the last half of my day.
Back into the Common, I grab an Italian sausage with pepper and onion from a cart and walk through the gardens. I’m listening to a podcast about a goofy episode of Star Trek and winding past brick and trees. Still a great day. I walk 20 minutes to the bakery I work at, wait in line, and offer to pay but get handed a cookie for free. I eat and think about the movie as I wait for my train home.
On the way, I read about the Science in the Capital Books, and Stanley’s far futures and listen to the Felice Brothers. All good stuff. I might be able to finish the last chapter tonight. The day is going well. I even start drafting some notes about what I did for a potential “Day(off) in the life of Arken” post. That’s why I remember all this.
I stop by the store, grab some veggies and eggs to make quiche, and then walk the last few train stops home. When I get to my apartment, I unpack and realize I forgot something. No quiche tonight. I should write that blog post instead so I can do at least one of the “productive” fun activities I planned over the day.
As I sit down to type, I get a message on Discord from a friend I hadn’t heard from in a while. He said he had a game project he’s been working on and asked if I could test it. He asked if I could look at it now. It’d only take 5 minutes. I’m feeling happy. I’m feeling generous. I think about how fun it would be to add testing a creative project to help a friend to my day in the life post. I want to be the kind of person people send their art to!
So I open the link he sends. Send a DM complementing the cool website. Download a file. Joke with Wesley, who got home a few minutes before I got the discord message, about how this better not be a virus. I unzip the folder and run the program. After a few seconds, I get an error message like it failed to start. I try one more time hoping I can troubleshoot myself before telling the friend that the demo had an issue. After my second attempt I moved back to Discord to share my experience.
I try to message and get a fail to send prompt. Discord is weird sometimes so I am trying to resend when my “friend” drops the act. He (I’ll stick with male description because my friend was a guy, and that’s the image I had) says something like “you’ve been hacked bro” and “ i got you” and then a list of 10 or so passwords saved on my browser followed by a few of my scanned IDs (stored on my Google Drive for my trip abroad in case of emergencies). I sit back and sigh to Wesley that it was in fact a virus. My generosity and day deflate. After that sigh, I get about dealing with the problem.
He wants $250 and promises to share his screen so I can see that he deletes all my data if I send the money.
“you can trust me”
I physically shut off the computer. They had access to my computer for about 5 minutes, so I hope he didn’t do a lot but can’t be sure at this point. On my phone I log into my Google account and secure my email. Secure my recovery email next.
Then, I try to send a warning to friends on Discord, thinking of warning people to not click links from the account I fell for at this point. Message doesn’t go through. My phone asks me to sign back into discord because the account password has been changed. I walk over to Wesley and use their phone to join the biggest server of friends and send out an alert. I text a few DnD friends who come to mind and aren’t in that server. I can tell I’m forgetting people I should warn, but don’t have time to do more.
I move over to my dining room table. Force sign off all devices from my Google account. By then, I had pieced together that all the data he showed me was from my browser and Google Drive. I don’t know what else they could have gotten. I get a message on WhatsApp from a new number, again with pictures of my IDs.
“don’t do this bro”
“i want this to end well for both of us”
A video call comes in. I ignore it.
I change my banking passwords, and check my account they spent $21 across four purchases on Steam to buy gift cards. I call my bank and open the app Steam as I go through the robot voice security screening. I see that they gifted an account a $20 Steam game. It’s a stupid looking simulator about being a drug dealer. Classy. My bank representative is helpful and I cancel my debit card and dispute the steam purchases. Wesley has to help me remember my area code because my mind blanks halfway through confirming our address. I thank the rep and decline to take a survey. I make a report for Discord support, and confirm that I can’t reset my account on my own.
I get an email from the hacker.
This makes me feel better. He doesn’t seem to have access to my email any more, and my friends have mass reported my hacked account. Hopefully that is locked down and won’t infect anyone else. I ignore the email and forward it to Discord support who responded to my ticket request but gave little information.
At around this point, I send out a few more warnings to friends over text and finally find my laptop (it was on the coffee table in full view but I didn’t see it after multiple scans of the apartment). I start formatting a USB to reinstall windows on my PC and wipe everything when I turn it back on. Daniel, of Star Realms fame, doesn’t seem to know who I am and I figure out he’s changed numbers. I have been speaking to him on Discord for the past many months and never noticed. Not a good start. Another friend helps me warn Daniel through Discord and gives me his new number. I message there. He answers.
Daniel is a computer security professional so in addition to warning, I ask for advice and if he can call. He doesn’t know if his phone will do an international call. Asks if I have WhatsApp. I call him and find out he and another friend are traveling in Japan and just woke up. I try to show that I’m thankful he took my call and explain the whole situation quickly. He thinks I did most of the right things so far, and walks me through how to check for unusual activity on our router. While he’s on the line Wesley changes our WIFI ID and password. It kicks all of our devices off the network, and hopefully any of the hackers.
I thank Daniel, wish him well in Japan, and get to starting a fresh instillation of Windows on my PC. Things load. I send out more warnings. Wesley giggles at the antics of my discord fiends who are all reacting to my foolishness, reporting who was important enough for the hacker to DM, and some even realizing we weren’t official friends and sending friend requests to the hacked account. Just as when I built the PC I forget about WIFI drivers and have to pull out my laptop again. This whole time I am checking for any other activity. No emails about sign in attempts or purchases. No two factor authentication requests (in the week since all this I am luckily finding out I had 2FA already set up on almost everything EXCEPT Discord lol).
Once windows is installed I shut the computer off and proceed to change all my most important passwords on my laptop. Wesley informs me you can’t report Identity Theft with the FTC during a government shutdown, so that’s great. I look into cancelling my IDs and reporting the ID theft. Is that even necessary? Lots of questions. Nothing new from the hacker.
At this point, they have whatever they downloaded from my computer, but I didn’t honestly have much that would be super damaging. I make a list of actions to take and what could be most damaging. I look into placing credit freezes and report fraud with credit agencies. More changing of passwords. More checking on all of my and Wesley’s devices. No weird activity on the router. I might be as safe as I can be for the evening.
Wesley, who almost never cooks, has made some pasta. We watch TV on their computer as we eat.
I work early tomorrow, so it’s time to go to bed. I did not sleep well.
The next few days were not great. At work on Saturday I felt monochrome and exhausted, and warned my bosses that I might have to duck upstairs to make some calls if anything weird showed up on my email or bank account. Nothing did. I still had to check every few minutes. I couldn’t focus to read on the train or find music that didn’t get in the way of my mental to do list making and damage control. When I got home, I continued to change passwords, activate 2FA wherever possible, and generally stress. I do homework on my laptop at my desk in front of my inert monitors.
At least I was tired enough to actually sleep early.
The next day was better and still no new suspicious activity. I get brave enough to turn on my computer. I don’t reinstall anything other than antivirus stuff for this evening. I try to do school on my laptop and continue to scan and monitor the blank and vacant PC. No warning signs. I shut it off for the night.
Things calm down a little more each day. My new debit card is in the mail. I’m now playing the fun game of will it arrive before I run out of money on my metro card. I slowly test the waters and monitor my computer and all our devices and try to feel better. That has mixed results. I use my computer to do the video call for my family book club, which means signing into Google again.
After 5 days, I get the news from Discord Support. They won’t reactivate my account. Arken is Dead. I had been occasionally checking in on my friends with Wesley’s phone, but hadn’t wanted to make a new account until I got a final determination from Discord. Dozens of times on the train and during my break at work, I had tried to open the Discord app only to be met with a sign in screen. I knew it before, but now I really felt how much Discord was my only “social” media and the only obsessive scrolling I allow myself to do. I did miss it. I did miss them.
I was very lucky that they missed me too! The welcome I received on my new account was very heartwarming and was worth celebrating after my stupidity induced exile.
Although Arken is Dead, he was lucky enough to come back as a zombie. I’ll keep losing sleep for a while, keep checking my credit score, keep making lists for damage control, and report to the FTC as soon as the shutdown ends. But I’m undead and mostly unharmed.
Have a better week than I did!
I haven’t played Pathless yet, but Sword of the Sea is clearly a Journey and Abzu successor.
Wishing ill upon the hacker, but, wow, I just loved reading this. The descriptions of your day off before it all went wrong were superb. Was very fun to be in Arkenworld and walk around Boston. Those blissful moments before the digital doom!!
Sorry your beautiful day off got turned upside down. Glad you recovered and reset. Most importantly though: you have a wool/possum fur sweater!!!! That sounds incredible! I ❤️ possums!