User Name changed and notes are missing

[SWS NOT Lulu 1]

Something happened on Monday after 10 years of a paid subscription, my user name was changed from my initials sw to "lulu"! And 777 notes were in the trash! I did not put the notes there nor change my user name. There are additional notes missing completely, notes that I worked on recently and notes I haven't viewed in weeks. The online customer support was not supportive and did not address how my user name could have changed without my knowledge. There suggestion to restore 777 individual items in the trash one by one is also not helpful. 

[SWS NOT Lulu 1]

The name change and missing notes are on both my PC and my Android phone app. 

[AlbertR 548]

Please check access history of your account (Extra -> Kontoinformationen... -> Zugriffsverlauf in German - don't know wording in other languages 🤔).

Because it's not only one change (done by accident by youself), someone else might have access to your account!

[agsteele 2,956]

First of all. Check that the linked Email address is still yours. Then change your password and apply two-factor authentication. You might also change your Email password since unauthorized access to your Email could be a way to regain the account.

Once you have secured your account you can set about restoring the 777 deleted notes. You can do this 100 notes at a time. So eight groups of 100 or 77 notes. Not too onerous. More demanding will be refiling then to whichever notebook they originally came from.

[SWS NOT Lulu 1]

6 hours ago, AlbertR said:

Please check access history of your account (Extra -> Kontoinformationen... -> Zugriffsverlauf in German - don't know wording in other languages 🤔).

Because it's not only one change (done by accident by youself), someone else might have access to your account!

Thank you, I checked the access history and it appears to be only my two devices (PC and Phone) and in places I have traveled. Unfortunately, I have more notes than 777 in my 10 year history with Evernote. Some are just missing and not even in the trash. Important records and addresses I stored here are completely gone. I'm so upset about the time I am taking to find a solution with no help whatsoever from Evernote themselves! I appreciate your suggestion. 

[SWS NOT Lulu 1]

Actually, under Authorized Access there appears to be one that is not my Samsung Android called Android-Amazon-KFDOWI. I'm not educated on what this means. Is there a way for Evernote to find all the missing data in their backup cloud (including notes not in the trash) and reload it to a clean account for me? 

Also there's a long list of Authorized Access under Evernote Web Clipper for Chrome. I didn't clip hundreds of clips from Chrome at once. I have been trying to load a few important notes back from the trash, but am also worried that the account is hacked and someone else can see my notes. I will respond to AGSteele about my linked email. I use my email to login and that's the same. Where do I check my "linked email"? Thank you for your help!

 

[SWS NOT Lulu 1]

Thank you 

6 hours ago, agsteele said:

First of all. Check that the linked Email address is still yours. Then change your password and apply two-factor authentication. You might also change your Email password since unauthorized access to your Email could be a way to regain the account.

Once you have secured your account you can set about restoring the 777 deleted notes. You can do this 100 notes at a time. So eight groups of 100 or 77 notes. Not too onerous. More demanding will be refiling then to whichever notebook they originally came from.

My email address associated with the account is still my email. I use it as login. I just changed my Evernote password and set up two factor authorization. Thank you for that advice. Under "Account Summary" there's a strange email address under "Email Notes to" but I think that link is generated by Evernote as it says "Email your notes, snapshots, and audio clips directly into your account. Emailed notes will go directly into your default notebook."

I don't plan to ever use Evernote again after this as they have offered no support and are not responding adequately (thoroughly addressing each of my concerns), so I will not need to move everything from my trash. I'll just copy them into another note program with better support. I just wish I could access my account as it was from Jan 22 before this happened and hundreds of additional notes disappeared (they are not among the 777 in my trash). 

[AlbertR 548]

2 hours ago, SWS NOT Lulu said:

I just wish I could access my account as it was from Jan 22 before this happened

Sorry to hear that you didn't get real help from support till now. Please add a link to this thread to your tickets and beg (once more) to reset your account to just before Jan 22 from their backup. I can't believe that this will not be possible...

And in case they made it possible, please give a short success message - would be great 🙏 - THX

 

[Dave-in-Decatur 3,979]

2 hours ago, SWS NOT Lulu said:

Actually, under Authorized Access there appears to be one that is not my Samsung Android called Android-Amazon-KFDOWI. I'm not educated on what this means. Is there a way for Evernote to find all the missing data in their backup cloud (including notes not in the trash) and reload it to a clean account for me? 

Also there's a long list of Authorized Access under Evernote Web Clipper for Chrome. I didn't clip hundreds of clips from Chrome at once. I have been trying to load a few important notes back from the trash, but am also worried that the account is hacked and someone else can see my notes. I will respond to AGSteele about my linked email. I use my email to login and that's the same. Where do I check my "linked email"? Thank you for your help!

The KFDOWI device would be a Kindle Fire running the Android operating system (some information here, not all of it relevant to your situation: https://appuals.com/what-is-kfdowi-and-how-to-remove-it-from-showing-up-on-your-network/). If you don't use a Kindle, this definitely shouldn't be there. Check the devices page (https://www.evernote.com/Devices.action) and if a Kindle or anything else you don't recognize is listed there, revoke it.

I wouldn't worry about the Web Clipper accesses too much. I think they represent one browser tab with the Web Clipper extension on it, not necessarily a use of it. But if you've never put the WC extension on your browser (it will always say Chrome, whatever the browser, I think), then that also could be a problem.

Evernote support should be able to find your missing notes. I don't blame you for leaving Evernote under these circumstances. Hacked Evernote accounts are rare, but it may have happened here, and they should take it with great seriousness. Even once you've got your 777 remaining notes on a different service, keep pounding on  the door of Evernote support until they find the notes that have gone missing altogether.

[SWS NOT Lulu 1]

I tried to contact Evernote to report this possible breech beginning on Jan 22 when all my notes either disappeared or a large number (777) were in the trash and my user name changed (not by me!).

As of this evening I have resolved this glitch/hack/unexplainable (except perhaps a hack from an old Kindle as pointed out here?). Evernote support was unreachable in any quick way, and then very slow in responding to my case (days of waiting back and forth) and would only address one of several questions in my ticket, and each time it took several days for a response. So definitely terrible customer service/tech support for a pretty urgent manner. They did provide me with a data file eventually on Jan 29, which I had questions about accessing, and after waiting another four days for an answer, I was able to open and import most of my missing files. I couldn't do too many at once and I did receive an error message every 6 or 7th file and would just delete that note.

I have asked a number of times if they could tell if my data was downloaded by anyone, and finally found out that they can't give me this information, so I'm just hanging passwords on everything. I use 1 Password and didn't really keep passwords in NEverNote but I did keep sensitive information. 

I moved my imported notes to other more supported apps and will be closing my paid Evernote account of 12 years, as the amount of time it took Evernote to respond to my desperate pleas for my lost data was unacceptable. The ability to have a live chat or phone call could have resolved what took weeks much faster,  but this company is obviously not putting customer support first. Thank you all here for your advice, which was immediate and helpful. 

[PinkElephant 8,189]

Nothing surprising here: First you had bad account security. 2FA not enabled, and probably (at least this is what we often see) a password used for several services, or a password concept easy to crack. The user and PW gets stolen at one service and is then tried on several others. All this are automated hacking processes, performed by bots. Humans only come into the picture when the bots report success.

That the hacker registers as a weird device is normal. In former cracks reported here (all with bad account security …) it was often an iPhone that got registered. In fact it is none of these, it is a hacker‘s server running programs that do the hacking.

There is note history to make a restore if needed. However if a note is deleted, note history is lost. In your case the hackers didn‘t think about (or cared for) emptying the trash.

All this is about how you handle your account(s), not about how EN or other services handle security. You should rethink account security, and get advise if necessary.

Support sucks, that‘s where we can agree. In fact in your situation (email still unchanged, account still intact, only a security gap to be plugged) you didn‘t need it to solve the issue. But of course they should be there, react fast and give answers that are tailored to your situation.

[Dave-in-Decatur 3,979]

I'd agree with @PinkElephant that security practices should be reviewed in your case, which it sounds like you've done. But this kind of note-deletion hack (assuming that's what it was) is really rare, and we don't know what kind of security you had actually used on the Evernote account. Obviously, which you're probably also doing, the greatest attention should go to any sensitive material stored in Evernote that may have been compromised.

As for customer service, it was mediocre a couple of years ago, then Bending Spoons took over Evernote, moved fast and both improved and broke things, increasing the demands on support staff, whom they apparently proceeded to fire and hire all new people, who of course had a learning mountain to climb. All of this idiocy is definitely on Evernote's current management, and I don't blame you for looking elsewhere after such a traumatic event. Even in an overwhelmed and understaffed support setting, there should be prioritization of events like what happened to you, and they should be assigned to the most capable people for immediate attention, IMHO.