‘Can happen to anyone' really means ‘anyone': abc27 meteorologist's Facebook account hacked

Yahoo

28-03-2025

HARRISBURG, Pa. (WHTM) — It all happened during a two-to-three hour period while Meteorologist Dan Tomaso was sleeping — which, given the times he can appear delivering the weather morning, noon and night, can be literally any time of day.
'I'm barely awake, and next thing I know, I'm getting texts from friends and family saying, 'What is this post on Facebook? Is everything okay?' Tomaso said.
It was a post on a personal account he uses sporadically to keep in touch with close friends and family.
'My dad's going into a long-term care facility,' Tomaso said, characterizing the fake post. 'We're gonna start offloading some of his things — including cars, dune buggies.'
Tomaso is 'not a dune buggy guy,' he said, and thankfully, both of his parents are fine. But the post was so realistic that a friend sent $500 via Venmo to a scam artist, who had hacked Tomaso's account and changed the credentials so Tomaso himself could no longer get in. Other friends he hadn't heard from in years contacted Tomaso to ask if items
Tomaso said he tried to contact Facebook support, as any other user would do, but with little success. He managed to chat with a support agent through a different paid 'Meta Verified' account; that ultimately led to help regaining control of his account after about a week, he said.
Tomaso concedes he unknowingly made one mistake: The personal account was so old (from back when he was in high school) that multi-factor authentication (i.e., security requiring something other than just a password) didn't exist when he created it, and he never thought to enable it later, even though he says he's security conscious and has safeguards on his other accounts.
Jonathan S. Weissman, a principal lecturer in cybersecurity at Rochester Institute of Technology, recommends what's known as an authenticator app 'like Google Authenticator or Microsoft Authenticator. If you do it with an authenticator app, the cyber criminals, in addition to your password, would physically need your phone,' Weissman said. 'The time is always now to implement multi-factor authentication on any account you have.'
Or as Tomaso put it: 'Just do it.'
Tomaso's other piece of advice is to be wary of uncharacteristic social media posts such as the one the hackers posted on his page. But Tomaso wonders: If the behavior (someone quickly changing his password and then posting something unlike anything he had ever posted on his page) is so obviously fraudulent to him, why didn't all the modern artificial intelligence available to a company like Facebook catch it?
Why, for that matter, didn't Google's Gmail filters flag as spam or phishing these three messages — with obvious red flags (from the unusual subject lines, to the personal email addresses for ostensible business mail, to the misspellings like 'State Farmm') sent to this reporter over the course of less than a day?
Spokespeople for Google and Meta, Facebook's parent company, didn't respond to requests for comment. But Weissman described cybersecurity as a 'cat-and-mouse' game between companies, whose systems really do have the best security they've ever had, and hackers, who work tirelessly to catch up.
'Cybercriminals are constantly changing their phishing methods — changing words, changing spelling,' Weissman said. In the case of what happened to Tomaso, 'there are many variations and permutations and combinations for Facebook to look for.'
Download the abc27 News+ app on your Roku, Amazon Fire TV Stick, and Apple TV devices
Or Google, he said, has to strike a balance between flagging dangerous messages and not incorrectly blocking legitimate ones, which could be just as disruptive to a user who misses an important message. Weissman said it's like a seesaw where 'on one side, you have security, and on the other side, you have convenience. When one side goes up, the other side goes down.'
Copyright 2025 Nexstar Media, Inc. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed.