@Anonymous wrote:
I found out, purely by accident, last week that my DFS account had been hacked and someone had ordered something from Microsoft for almost $3000. I discovered this theft! Dell did not! I have been told by phone that the purchase was reported to the three credit bureaus ( my FICO credit score has since dropped 11 points) and that nothing can be done to correct the problem with the credit bureaus for up to 60 days. I was given a case number last week and when I checked online today, Tuesday, the case number seems to be non-existent. A second phone call to the Fraud Phone Number revealed that there will be no information regarding my case until an investigator has been assigned, sometime in the the next 30-45 days. In the meantime, this almost $3000 order is being shipped to someone who just stole $3000. and nothing is being done about it. (I understand that I will not be held responsible for paying this charge, but right now someone has just walked off with a $3000. door prize. ) How did the hacker get my password? It is a password that I ONLY use for this DFS account. No other accounts from other entities have been broached in any way Why and how, only Dell?
A common thought I hear a lot is that a strong password = strong security. This is not the case. There is also a common thought that if someone hacked into your account, it's because they cracked your password. This is also very, very often not the case.
Much more common is to take the easy path in. Find a vulnerability on the server and root it. Don't need anybody's password then. If they're decent, they won't leave a crashed daemon from a noop sled or other traces that amateur admins will find with little effort. Or they'll use XSS or read cookies with PW info in them or any of a number of other poor web practices used by pretty much everyone. Or they'll just socially engineer they way in by having a modicum of basic background information about you and are able to sound semi-convincingly that they're you and are supposed to be there. You'd be amazed how many reps will back off from a hunch because they don't want to deal with confrontation or piss off what they fear might be an over-entitled customer.
Anyone who thinks the big hacks in the world took Mission Impossible type gear and skills doesn't know crap about cybersecurity. The stuff we come to rely on was written by humans who think like humans, make rookie mistakes like humans, or don't think about how something could be so misused to bite them later (like the goons who though SUBs were a good idea, that won't be exploited).
At some point, we can't say it's gross incompetence because it seems to happen to even the best of companies.
As for the rest, I'm not sure exactly what you want them to do about it right now. You have a case open, they'll review it, assess damage done, and move on. You're already comfortable that you won't be liable for the charge, so you already have pretty much the best possible outcome here, unless you're hoping they'll deploy a special ops team to the bad guy's house to take the $3000 worth of stuff back and haul him off to hacker jail. Not for $3,000 they won't; they've already baked losses like that into the cost of doing business. Depending on where it was sold to, there may even be absolutely nothing illegal about what they did, and thus no action can be taken against them.
