The nightmare began with an annoyance as benign and commonplace as a housefly. “Hi there Matt,” the July 11, 2024, email read. “We received a message from you earlier today through our support page related to a changed password on your account … If you didn’t make a support request,” the sender asked politely, “please let us know.” Matthew Van Andel, 44, who goes by the nickname Dutch, had never heard of “nullbulge.se,” the domain name that sent the message. It appeared to be a classic phishing