--:-- Ryan Knudsen: Welcome to The Journal, our show about money, business, and power. I'm Ryan Knudsen.
--:-- Ryan Knudsen: Today, we're talking about a story that's both fascinating and terrifying. It's about a man who accidentally downloaded a Trojan horse that gave a hacker access to his entire computer. But that's not all - the hacker didn't just get his information. It also got his employer: Disney.
--:-- Ryan Knudsen: Our guest today is Dutch Van Handel, a software engineering manager who lives in the suburbs of Los Angeles. Dutch, thanks for joining us.
--:-- Dutch Van Handel: Thanks for having me, Ryan.
--:-- Ryan Knudsen: So, Dutch, where does this story start?
--:-- Dutch Van Handel: I'm not quite sure. I didn't even realize it was that long ago at first until after the FBI had visited and I told them I would put together like a detailed timeline for them.
--:-- Ryan Knudsen: Up until last year, you lived a pretty ordinary life. You're a software engineering manager, married with two kids, and you live in the suburbs of Los Angeles. But last year, something happened that turned your ordinary life upside down.
--:-- Dutch Van Handel: It started when I downloaded a seemingly innocuous program onto my personal computer. It was an AI software and it could generate images. I wanted something my sons could play with.
--:-- Ryan Knudsen: You wanted to generate pictures of Easter bunnies and Roblox people and stuff like that.
--:-- Dutch Van Handel: Yeah, that's right.
--:-- Ryan Knudsen: But you didn't know it at the time, but the program had a malicious code in it. A code that gave a hacker access to your computer.
--:-- Dutch Van Handel: That's right. And over a period of months, that hacker stole all of my personal information, like my bank accounts and passwords.
--:-- Ryan Knudsen: They're getting into things they shouldn't have because they've got my social security number, they've got my birthday, they've got my email address.
--:-- Dutch Van Handel: Yeah, that's right.
--:-- Ryan Knudsen: You can just make a phone call and pretend to be me because you have this information. It was a nightmare.
--:-- Dutch Van Handel: And it wasn't just my personal life that was hacked. Through me, the hacker also got inside my employer, Disney.
--:-- Ryan Knudsen: Disney has apparently been hit by a cyber attack. The hacking group Noble says it leaked thousands of internal Disney messages.
--:-- Dutch Van Handel: While my story is unusual, my life online wasn't. And what happened to me could happen to almost anyone.
--:-- Ryan Knudsen: These people, they may not be targeting you, but just because you work for somebody that they find interesting, they will destroy you to get at it.
--:-- Ryan Knudsen: Welcome to The Journal, our show about money, business, and power. I'm Ryan Knudsen. It's Monday, March 17th.
--:-- Ryan Knudsen: Coming up on the show, what it feels like to be at the center of a major hack on one of the world's largest companies.
--:-- Ryan Knudsen: CRM was supposed to improve customer relationships. Instead, it's shorthand for can't resolve much.
--:-- Ryan Knudsen: Which means you may have sunk a fortune into software that just bounces customer issues around but never actually solves them.
--:-- Ryan Knudsen: On the ServiceNow AI platform, CRM stands for something better.
--:-- Ryan Knudsen: With AI built into one platform, customers aren't mired in endless loops of automated indifference.
--:-- Ryan Knudsen: They get what they need, when they need it.
--:-- Ryan Knudsen: Bad CRM was then. This is ServiceNow.
--:-- Ryan Knudsen: This episode is brought to you by Walmart.
--:-- Ryan Knudsen: Did you know that Walmart is one of Fortune 100's best companies to work for in 2025?
--:-- Ryan Knudsen: It's no surprise. Walmart is investing $1 billion in training and development to help associates build lasting careers, with or without a degree.
--:-- Ryan Knudsen: In fact, 75% of Walmart management started in hourly roles.
--:-- Ryan Knudsen: With benefits like health care, paid parental leave, and tuition support, Walmart isn't just a place to work. It's a place to grow.
--:-- Ryan Knudsen: Learn more at walmart.com slash spark.
--:-- Ryan Knudsen: That is one impressive mustache.
--:-- Ryan Knudsen: Thank you.
--:-- Dutch Van Handel: My mustache is long, straight, and points directly out to the sides.
--:-- Dutch Van Handel: Started with just curling the corners with some wax, and I wanted to make a loop.
--:-- Ryan Knudsen: But it turns out every time it gets hot, my hair is stubborn and that loop turns into a hoop.
--:-- Dutch Van Handel: So I just started keeping it straight instead.
--:-- Ryan Knudsen: Dutch is 43 and his real name is Matthew.
--:-- Dutch Van Handel: I tend to go by Dutch because there's just too many mats everywhere you go.
--:-- Ryan Knudsen: I was the Dutch mat and then it just became Dutch.
--:-- Dutch Van Handel: The Dutch? Are you Dutch?
--:-- Ryan Knudsen: Yeah.
--:-- Dutch Van Handel: Yeah. It's well, you know, family name, Van Andel.
--:-- Ryan Knudsen: Grandparents were Dutch, so I'm like third generation, something like that.
--:-- Ryan Knudsen: The first sign that Dutch's life was about to be turned upside down happened last spring.
--:-- Dutch Van Handel: So in May, we have our credit cards stolen.
--:-- Ryan Knudsen: We're racking up thousands of dollars in these fraudulent credit card charges on like all of our credit cards.
--:-- Dutch Van Handel: And it's really bizarre and I couldn't figure out what exactly is going on.
--:-- Ryan Knudsen: Other weird things happened too. Like, his computer slowed down to the point where he couldn't even use it.
--:-- Ryan Knudsen: And then he got a suspicious login notification to his work account that he didn't recognize.
--:-- Dutch Van Handel: But July is when he knew something was really up.
--:-- Ryan Knudsen: That's when he got a message on Discord, a platform popular with gamers.
--:-- Dutch Van Handel: And there's this suspicious direct message.
--:-- Ryan Knudsen: The person's like, Frank, something, something.
--:-- Dutch Van Handel: And ordinarily, I just delete unsolicited direct messages from strangers.
--:-- Ryan Knudsen: But this one was really long.
--:-- Dutch Van Handel: The thing that caught his attention was that the message included details from a conversation he had on his work Slack account.
--:-- Ryan Knudsen: It was a chat about his lunch.
--:-- Dutch Van Handel: I think there is no way they should have this.
--:-- Ryan Knudsen: There's no way they should have that Slack conversation.
--:-- Dutch Van Handel: Slack was Disney's internal messaging platform at the time.
--:-- Ryan Knudsen: And it's supposed to be private. No one outside the company should have been able to see those messages.
--:-- Dutch Van Handel: The only way they have that Slack conversation is somehow my work computer is compromised.
--:-- Ryan Knudsen: So immediately, I closed the work computer.
--:-- Dutch Van Handel: Dutch came to the conclusion that he'd been hacked.
--:-- Ryan Knudsen: He got in touch with Disney's information security team, or InfoSec.
--:-- Dutch Van Handel: It responds to the company's IT emergencies.
--:-- Ryan Knudsen: And I say, hey, I got this thing. It sounds like an extortion message, and they have a thing in there from Slack that they should not have access to.
--:-- Dutch Van Handel: Dutch says InfoSec looked into it and said his work laptop look fine and that he should check his personal computer.
--:-- Ryan Knudsen: So Dutch ran an antivirus program.
--:-- Dutch Van Handel: And immediately it picks up this file in my downloads.
--:-- Ryan Knudsen: It says, oh, Trojan detected.
--:-- Dutch Van Handel: That AI plugin Dutch had downloaded so that his kids could generate images of Easter bunnies and Roblox characters.
--:-- Ryan Knudsen: That program had a hidden virus.
--:-- Dutch Van Handel: So I look it up, and I find this Reddit thread where somebody's like, this is malware.
--:-- Ryan Knudsen: It steals all your passwords. If you downloaded this, change all of your passwords immediately, like right now, that somebody has your passwords.
--:-- Dutch Van Handel: So I let InfoSec know.
--:-- Ryan Knudsen: I'm like, you know, I think they maybe got in through my PC.
--:-- Dutch Van Handel: Dutch said that Disney's InfoSec agreed, and they told him that a hacker had also gotten into Disney systems, and they were downloading massive amounts of data.
--:-- Ryan Knudsen: And that's where it starts setting in, like, this panic.
--:-- Dutch Van Handel: You know, I'm still not sure, like, how they had gotten to the Disney system.
--:-- Ryan Knudsen: So, like, well, how could they get past, like, the two-factor authentication?
--:-- Dutch Van Handel: While Dutch was on the phone with InfoSec, he also had his email account open.
--:-- Ryan Knudsen: And he noticed a spammy-looking message show up in his inbox.
--:-- Dutch Van Handel: He deleted it. But then he got another one right away.
--:-- Ryan Knudsen: And this one is exactly the same as the Discord.
--:-- Dutch Van Handel: So they're definitely trying to get a hold of me.
--:-- Ryan Knudsen: And the timing is also weird.
--:-- Dutch Van Handel: Like, why am I getting this now while I'm, like, here in my email?
--:-- Ryan Knudsen: Like, are they watching me somehow?
--:-- Dutch Van Handel: Yes.
--:-- Ryan Knudsen: And I, like, kind of panic and I, like, hit the trash button.
--:-- Ryan Knudsen: And then they send a third email saying, we saw what you did.
--:-- Dutch Van Handel: Oh, my God.
--:-- Ryan Knudsen: That's where things start to get bad.
--:-- Dutch Van Handel: You know they're watching you.
--:-- Ryan Knudsen: In that third email, the hacker also sent a threat.
--:-- Dutch Van Handel: It said, quote, Respond, do what we want Or end up on the net.
--:-- Ryan Knudsen: They're not just in Slack. They're in my email.
--:-- Dutch Van Handel: That means they're probably in my Discord.
--:-- Ryan Knudsen: And I'm thinking, how? How is this possible?
--:-- Dutch Van Handel: It doesn't take long for me to figure out maybe just a few seconds, they're in my 1Password.
--:-- Ryan Knudsen: It is the only way.
--:-- Dutch Van Handel: 1Password is a password manager.
--:-- Ryan Knudsen: It's considered a way to protect your digital life.
--:-- Dutch Van Handel: And it's often recommended by security experts as a way to make sure you don't get hacked.
--:-- Ryan Knudsen: The hacker was able to get into Dutch's 1Password account because Dutch didn't have two-factor authentication turned on.
--:-- Dutch Van Handel: That's those codes that get pushed to your phone to make sure it's really you.
--:-- Ryan Knudsen: Getting access to his 1Password account was bad.
--:-- Dutch Van Handel: Because not only did Dutch store all of his passwords there, he also stored personal information like birth certificates and social security numbers.
--:-- Ryan Knudsen: Information that Dutch had been accumulating for a decade.
--:-- Dutch Van Handel: And not only that, Dutch also used 1Password for two-factor authentication codes.
--:-- Ryan Knudsen: Meaning that by accessing his 1Password account, the hacker got Dutch's passwords and his two-factor codes.
--:-- Dutch Van Handel: It was like they had the ultimate master key to Dutch's entire digital life.
--:-- Ryan Knudsen: And I tell InfoSec, oh my God, I think they got my one password.
--:-- Ryan Knudsen: They have to have my two-factor codes.
--:-- Dutch Van Handel: This is the only way they could get into this stuff.
--:-- Ryan Knudsen: So at that point, you know, they're like, okay, well, you need to work on securing your personal stuff.
--:-- Dutch Van Handel: Once he realized this, Dutch had a lot of work to do.
--:-- Ryan Knudsen: So the game plan, like immediately I'm like, how do I get them out?
--:-- Dutch Van Handel: And they have threatened to retaliate.
--:-- Ryan Knudsen: So I think, okay, I need to secure our financial accounts first.
--:-- Dutch Van Handel: Secure bank accounts and all financials.
--:-- Ryan Knudsen: Secure social media.
--:-- Dutch Van Handel: Secure medical.
--:-- Ryan Knudsen: Secure all this sensitive personal stuff as fast as I could right now.
--:-- Ryan Knudsen: And did you buy a new computer to do all this stuff?
--:-- Dutch Van Handel: Because they're in your computer, right?
--:-- Ryan Knudsen: They're on my gaming PC, yes.
--:-- Dutch Van Handel: I've already determined that my wife's MacBook is fine.
--:-- Ryan Knudsen: So I'm working on that. I'm working on her MacBook.
--:-- Dutch Van Handel: So first I secure those accounts as quickly as I can.
--:-- Ryan Knudsen: Change the passwords and all that.
--:-- Dutch Van Handel: Yeah.
--:-- Ryan Knudsen: And we just start erasing everything.
--:-- Ryan Knudsen: We're reformatting computers.
--:-- Dutch Van Handel: I just go straight through the night.
--:-- Ryan Knudsen: Dutch said he got a call from Disney's InfoSec team the next morning.
--:-- Dutch Van Handel: And they told him that the hacker had doxxed him and his family.
--:-- Ryan Knudsen: Meaning they followed through on their threat to put Dutch information online.
--:-- Dutch Van Handel: All of his personal information, his passwords, his family birth certificates, everything was now available for anyone to see.
--:-- Ryan Knudsen: Accounts are now actively hijacked.
--:-- Dutch Van Handel: Like, people are getting into them, they're sabotaging them, they're, you know, changing passwords and vandalizing accounts.
--:-- Ryan Knudsen: You know, my kids' Roblox accounts were hijacked and stolen, and they changed the passwords and tried to lock us out.
--:-- Dutch Van Handel: And I'm just, at this point now, not only am I trying to make my way through the list, but I'm trying to recover things as they're being taken.
--:-- Ryan Knudsen: I'm trying to actively block people who are trying to get into things.
--:-- Dutch Van Handel: And it's just nonstop.
--:-- Ryan Knudsen: Meanwhile, at his employer, Disney, they were having problems with the hacker too.
--:-- Dutch Van Handel: And Dutch's nightmare was about to get a lot worse.
--:-- Ryan Knudsen: That's next.
--:-- Ryan Knudsen: This episode is brought to you by Indeed.
--:-- Ryan Knudsen: When your fridge stops working, you don't sit around waiting for all your food to spoil.
--:-- Ryan Knudsen: You find a solution.
--:-- Ryan Knudsen: So why wait to hire the people your company desperately needs?
--:-- Ryan Knudsen: Use Indeed Sponsored Jobs to find great talent fast.
--:-- Ryan Knudsen: It moves your job posts to the top of the page, so it's the first thing relevant candidates see when they start searching.
--:-- Ryan Knudsen: And it truly does make a difference.
--:-- Ryan Knudsen: Sponsored jobs receive 45% more applications than non-sponsored jobs, according to Indeed data.
--:-- Ryan Knudsen: Plus, with sponsored jobs, there are no monthly subscriptions or long-term contracts.
--:-- Ryan Knudsen: You're only paying for results.
--:-- Ryan Knudsen: There's no need to wait any longer.
--:-- Ryan Knudsen: Speed up your hiring right now with Indeed.
--:-- Ryan Knudsen: Listeners of this show will get a $75 sponsored job credit to get your jobs more visibility at indeed.com slash journal.
--:-- Ryan Knudsen: That's indeed.com slash journal right now and support the show by saying you heard about Indeed on this podcast.
--:-- Ryan Knudsen: Indeed.com slash journal.
--:-- Ryan Knudsen: Terms and conditions apply.
--:-- Ryan Knudsen: Hiring Indeed is all you need.
--:-- Ryan Knudsen: Optimism isn't sunshine and rainbows.
--:-- Ryan Knudsen: It's fixing things, changing things, changing the way we fix things, rolled up sleeves, breaking through, growing power to meet growing needs.
--:-- Ryan Knudsen: Working to run the world on smarter energy every day.
--:-- Ryan Knudsen: Taking power where the grid's never been, then getting up and doing it again.
--:-- Ryan Knudsen: Because if optimism never stops, then change can't either.
--:-- Ryan Knudsen: GE Vernova, the energy of change.
--:-- Ryan Knudsen: The same morning that a hacker made all of Dutch's personal information public, they also released massive amounts of Disney data online.
--:-- Ryan Knudsen: Troves of confidential information, including things like passport numbers for cruise workers and sales of theme park passes and streaming data.
--:-- Ryan Knudsen: Disney is investigating a July data leak of its internal Slack channels.
--:-- Ryan Knudsen: Hacktivist group called Null Bulge has come out saying it has leaked more than one terabyte of information from Disney's Slack.
--:-- Ryan Knudsen: That's a software platform.
--:-- Ryan Knudsen: That one terabyte of Disney data included more than 44 million Slack messages, 18,000 spreadsheets, and 13,000 PDFs.
--:-- Ryan Knudsen: And the hacker got it all through Dutch.
--:-- Ryan Knudsen: Saying it gained access through a Slack user who had cookies.
--:-- Ryan Knudsen: Disney says it's investigating the matter.
--:-- Ryan Knudsen: The Wall Street Journal was the first news outlet to report the contents of what the hacker released.
--:-- Ryan Knudsen: The stolen information gave a rare look inside the inner workings of a big company.
--:-- Ryan Knudsen: There were discussions of ad campaigns, studio technology, and information about unreleased projects.
--:-- Ryan Knudsen: There was even revenue data about each of Disney's streaming services, which had never been made public before.
--:-- Ryan Knudsen: In a regulatory filing last summer, Disney said it was investigating the incident, but that it wasn't expected to have a material impact on its operations or financial performance.
--:-- Ryan Knudsen: Among the things that the hacker put out there in the data dump was also a claim that Dutch was in on it.
--:-- Ryan Knudsen: And then I start getting messages from press.
--:-- Ryan Knudsen: The media is starting to reach out to me.
--:-- Ryan Knudsen: People are messaging me on LinkedIn and saying, Why did you hack your employer?
--:-- Ryan Knudsen: Because you can trust something that a hacker says on their website as they dox that person.
--:-- Dutch Van Handel: Dutch says that he was not part of the hack.
--:-- Ryan Knudsen: So a week goes by, again, I'm fending people off still.
--:-- Ryan Knudsen: People are just actively, day and night, nonstop, trying to get into things.
--:-- Ryan Knudsen: I'm still, like, having panic attacks every time my phone makes a sound.
--:-- Ryan Knudsen: You know, like, you get the notifications as people are trying to get in.
--:-- Ryan Knudsen: Ding, ding, ding, ding, ding, ding.
--:-- Ryan Knudsen: Eventually, after Dutch finished changing all of his passwords, things started to calm down, and he tried to get back to his job.
--:-- Ryan Knudsen: And I'm like, okay, maybe I should see if I can start doing a little bit of work again.
--:-- Ryan Knudsen: And I get this call, and it's from a Disney area code.
--:-- Ryan Knudsen: So I pick it up and you know they introduce themselves from like Disney HR.
--:-- Ryan Knudsen: And they like how are you doing Dutch.
--:-- Ryan Knudsen: And I go well you know I surviving.
--:-- Ryan Knudsen: And they go well the reason we called you know, is during the investigation of your computer, we discovered that you had accessed pornographic content.
--:-- Ryan Knudsen: And I'm like, I'm completely at a loss.
--:-- Ryan Knudsen: I'm thinking, well, they, I guess they must have called the wrong person.
--:-- Ryan Knudsen: And I'm like, no, I'm the one that was hacked.
--:-- Ryan Knudsen: And they go, well, we determined that this has nothing to do with that.
--:-- Ryan Knudsen: And I'm like, well, but that's not true.
--:-- Ryan Knudsen: And they go, well, because you access pornographic content on a company computer, you're being terminated effectively immediately.
--:-- Ryan Knudsen: I don't remember much after that.
--:-- Dutch Van Handel: Dutch denies ever viewing pornography on his work computer.
--:-- Ryan Knudsen: In a statement, a Disney spokesperson said his denial is, quote, firmly refuted by the company's review of his company-issued device.
--:-- Ryan Knudsen: After you found out that you had been fired, like, what were you feeling?
--:-- Dutch Van Handel: Felt like my life was over.
--:-- Ryan Knudsen: Everything I had built, everything I had worked for, my relationships, projects, reputation.
--:-- Ryan Knudsen: It's all gone.
--:-- Dutch Van Handel: I thought I was going to retire there.
--:-- Ryan Knudsen: You know, I never thought when I started working there that I would work for a big company.
--:-- Ryan Knudsen: But Disney is one of the few companies I actually felt kind of good about.
--:-- Dutch Van Handel: Dutch said losing his job felt worse than getting hacked and doxed.
--:-- Ryan Knudsen: You know, this whole week, I had been surviving on the support of all these people at Disney.
--:-- Ryan Knudsen: Calling me, checking in, reaching out, making sure I'm okay.
--:-- Ryan Knudsen: Saying, look, this could happen to anybody.
--:-- Ryan Knudsen: Don't beat yourself up over it.
--:-- Ryan Knudsen: It's not your fault.
--:-- Dutch Van Handel: You know?
--:-- Ryan Knudsen: And then this.
--:-- Ryan Knudsen: Up until that point, did it feel like they had your back?
--:-- Dutch Van Handel: It did.
--:-- Ryan Knudsen: I thought they did.
--:-- Dutch Van Handel: I thought they supported me.
--:-- Ryan Knudsen: I thought they were going to protect me.
--:-- Dutch Van Handel: And my support network is gone.
--:-- Ryan Knudsen: Again, you know, that's...
--:-- Ryan Knudsen: I've been there for a long time.
--:-- Ryan Knudsen: You spend more time with those people than you do with your own family.
--:-- Ryan Knudsen: Your co-workers, yeah.
--:-- Dutch Van Handel: Yes.
--:-- Ryan Knudsen: I considered many of them genuine friends.
--:-- Ryan Knudsen: Dutch ended up finding another tech job in December.
--:-- Ryan Knudsen: And he says he's been in touch with the FBI about the hack.
--:-- Ryan Knudsen: Still, he felt burned by Disney.
--:-- Ryan Knudsen: It's like my identity was tied up there, and it was just taken away, you know?
--:-- Ryan Knudsen: I don't know, it just feels like I'm in my 40s, you know?
--:-- Ryan Knudsen: I'm not getting any younger, but my career has been thrown way, way, way back.
--:-- Ryan Knudsen: And there's no catching up.
--:-- Ryan Knudsen: There's no getting it back.
--:-- Ryan Knudsen: So he decided to sue.
--:-- Ryan Knudsen: In February, he filed a wrongful termination lawsuit against Disney, alleging slander and whistleblower retaliation for speaking out against the company's cybersecurity standards.
--:-- Ryan Knudsen: Disney did not comment on the lawsuit.
--:-- Ryan Knudsen: I always thought that I had a good security posture.
--:-- Ryan Knudsen: Obviously, little oversights are all it takes.
--:-- Ryan Knudsen: It's you know, I want to say hackers are getting sophisticated.
--:-- Ryan Knudsen: But it's not even a matter of sophistication.
--:-- Ryan Knudsen: It's just they can throw very wide nets very unsophisticated wide nets and just have patience.
--:-- Ryan Knudsen: I didn't think about this computer being anything other than a toy.
--:-- Ryan Knudsen: I always figured if you get some malware on there you know reformat windows just maybe lose some games, reinstall them.
--:-- Ryan Knudsen: You know, what's the worst that could possibly happen on there?
--:-- Ryan Knudsen: This episode has been updated.
--:-- Ryan Knudsen: A previous version incorrectly stated that the program that contained the malicious code was called Vision LLM.
--:-- Ryan Knudsen: The code was actually hidden in a different piece of software he downloaded.
--:-- Ryan Knudsen: That's all for today.
--:-- Ryan Knudsen: Monday, March 17th.
--:-- Ryan Knudsen: The Journal is a co-production of Spotify and The Wall Street Journal.
--:-- Ryan Knudsen: Additional reporting in this episode by Bob McMillan, Sarah Krause, and Robbie Whelan.
--:-- Ryan Knudsen: Thanks for listening.
--:-- Ryan Knudsen: See you tomorrow.
--:-- Ryan Knudsen: Yo, this is important, man.
--:-- Ryan Knudsen: My favorite Lululemon shorts, the ones you got me back in the day, I think they're called Pacebreakers.
--:-- Ryan Knudsen: The ones with all the pockets.
--:-- Ryan Knudsen: I just got back from vacation and I left them in my hotel room.
--:-- Ryan Knudsen: And dude, I need to replace these shorts.
--:-- Ryan Knudsen: I wear them like three times a week.
--:-- Ryan Knudsen: Could you send me the link to where you got them?
--:-- Ryan Knudsen: Oh, also, my birthday's coming up soon.
--:-- Ryan Knudsen: So anyways, thanks, bro.
--:-- Ryan Knudsen: Talk soon.
--:-- Ryan Knudsen: Looking for your newest go-to's?
--:-- Ryan Knudsen: Lululemon What's New Gear drops on Tuesdays, every Tuesday.
--:-- Ryan Knudsen: Head to lululemon.com to shop what's new gear.
