@tychotithonus One interesting thing is that in one cases the hacker didn't appear to be using any sophisticated tools. Login history showed a chrome browser login from Lagos Nigeria and the added email accounts were designed to look similar to users existing emails including a diminutive form of a name (those were set up as Outlook.com addresses). Completely manual attack using Comcast's own management tools. Maybe don't allow account altering activities from Nigeria?!?