Hacker News Reader

Comment by lululouise | Hacker News Reader

Hey guys thanks so much for your response. I do believe 2 step was going but the hacker changed the details to his, wiped my phone and with it, my Google authenticator and presumably set it up on his phone! I'm completely locked from making any changes yet I can still see my emails and stuff but I can't change anything or verify myself. I did use the authenticator app plenty of times so I'm certain I had it set up. Although I'm starting to doubt myself now.... It's a nightmare!

View on HN

If you still have any devices that have your old data (cached, etc) it might be worth keeping them powered on but disconnected from the internet, so that they don't end up realizing they should no longer have access and delete what could be the last copy of your data that you can actually access.

Whatever you still have access to (again, from cache, existing browser that's still logged in, etc), start making backups - screenshots, etc.

I've backed up all my important things and emptied the account too, unfortunately it's probably too late as he may have downloaded all anyway as he used the Google takeout to get backup data. I'm not in that account at all now, after I backed up and emptied it, I factory reset my computer.

> I did use the authenticator app plenty of times so I'm certain I had it set up.

Then it would be been impossible to login. Did you use a password that was leaked? If yes - may be they logged in - and you would have got a 'notification' on your phone to allow them. And you perhaps said yes to that remote login.

You're not making sense. You need to slow down, calm down and write clearly and with more detail. Doubly so when communicating with Google Support staff.

She believes she had 2 factor because she used the app on her phone and would enter in codes. But her phone was remotely wiped (presumably by the attacker) and lost access to the authenticator. She can't verify that way anymore because the attacker took that tool away from her.

She is still logged into her account on the laptop, so she can see things, but can't make any changes (they require a password she no longer has since the attacker changed it). We saw what the attacker changed the recovery info to their email / phone as well. So recovery options aren't working. She is trying to pass their email/phone along to some form of law enforcement.

>> She is still logged into her account on the laptop, so she can see things, but can't make any changes

This doesn't make sense; the attacker changed all of her account information but didn't click "log out of all other locations"?

Bad actors make mistakes, too.

Sorry, I was in a panic , I have updated my situation in the comments , thank you

Try to use https://takeout.google.com/ to back up your account data.

We tried this, needed to validate your identity to get it. The hacker started it though, presumably to get all the data.

Reply on news.ycombinator.com