Hack attack

Idk if this is the place to put this so mods, feel free to remove if it doesn't fit. TLDR at bottom.

So many of us may have seen the recent articles regarding cyberspace, from concerns that rús sia is no longer being treated as an adversary by CISA to recent Gnail and outbook attack warnings.

Unfortunately, it's not terribly uncommon to find yourself on the offense of an attack, but last night, the activity I saw was a little more than peculiar. It started getting an email that my contact info was changed on my bank account and a zele contact was added.

So I go in and update my password to something crazy, delete the new contact info, make sure 2FA on, all that good stuff. I get an automated call from "my bank" saying the detected fraud and to press 1 if it's fraud and then to provide the pin that was just texted to me. Yea ok.. So I just mash a bunch of random numbers to give them "the pin". All good right?

I get another email saying that once again my contact info was changed. Now it's kind of getting into wtf territory, especially since I secured my emails a few days ago. So I go in and change everything again, this time bank has asked to recover my account with my SSN. And I call the bank to secure the account further. They say they can see all the things in describing, but that it's weird b/c they can't see how it was changed, if it was signed in to a different device to do so, etc. There wasn't much of an obvious paper trail. The whole time I'm on the phone with the bank, that same spoofed automated number is blowing me up back to back, but I don't answer.

I didn't get any clear answers, and I haven't had any funds taken, but a couple of things struck me as particularly sophisticated about this activity; my bank is connected to a proton account, not Gnail or outbook. It didn't look like proton was breached based on the superficial activity on that account, though apparently that's not definitive proof of anything. They were able to change the contact info again after I secured the account. The phone number they updated had a rüs sian country code. There was no obvious paper trail on the bank account. Were they able to recover my account with my SSN same way I did? Idk. I generally view myself as cyber aware, even if sometimes negligent about keeping my infosec as clean as it should be. I've never seen anything like this on my accounts.

TLDR: It looks a number associated with rüs sia or someone looking to create that image have rolled out a fairly sophisticated technique that goes beyond the recent Gnail and outbook warnings. It's not clear how the accounts were breached, but I'm concerned it could involve SSN numbers. Are we at risk for a wider cash grab? I'm not in forensic analysis, so take whatever my assumptions/concerns are with that in mind.

Edit: to remove insinuation of state sponsorship.