This is a terrifying story, which you have to read to believe:

In the space of one hour, my entire digital life was destroyed. First my Google account was taken over, then deleted. Next my Twitter account was compromised, and used as a platform to broadcast racist and homophobic messages. And worst of all, my AppleID account was broken into, and my hackers used it to remotely erase all of the data on my iPhone, iPad, and MacBook. [...]

But what happened to me exposes vital security flaws in several customer service systems, most notably Apple’s and Amazon’s. Apple tech support gave the hackers access to my iCloud account. Amazon tech support gave them the ability to see a piece of information — a partial credit card number — that Apple used to release information. In short, the very four digits that Amazon considers unimportant enough to display in the clear on the web are precisely the same ones that Apple considers secure enough to perform identity verification. The disconnect exposes flaws in data management policies endemic to the entire technology industry, and points to a looming nightmare as we enter the era of cloud computing and connected devices.

This is the story of how a highly competent and online-engaged individual was hacked “hard”, as his original blog post detailed.

I know how it was done now. Confirmed with both the hacker and Apple. It wasn’t password related. They got in via Apple tech support and some clever social engineering that let them bypass security questions.

The lesson? Arm yourself. Make sure you passwords are strong; if you use Gmail, set up 2-step authentication (where not just your password, but also a specifically SMS’d code is required to access your account) and for God’s sake, backup¹! Also, pray that Apple’s security mechanisms get better.

1. I use Dropbox, but am in the process of switching to BackBlaze, which seems simpler, not to mention, cheaper. [↩]