Trying not to be too dramatic here, but;
Port 22 is used for an "SSH Remote Login Protocol" (SSH means "Secure Shell") connection. These connections can be made over the internet if your router allows access. Your router did.
If you failed to set a remote access password for the ID when you initially set it up, as you suggest here:
What I need to understand is that with the new remote access password set for the Id (perhaps even for the first time due to the initial configuration challenges), is the Id now generally secure from unauthorized access?
and if the IP Address that port 22 was forwarded to was the Id, then I think anyone on the internet who port scanned your external internet address would have seen port 22 was open and could have connected to your Id simply by opening an SSH session and would not have required a password at all. Port scanning from the internet is very common and port 22 is almost always one of the ports scanned for.
Alternately, if you did set up a remote access password but it was easy to guess, or if it was left at some default that JRiver uses that could be easily guessed, then logging in would be simple.
Have you ever or do you ever want to connect to your Id from outside your LAN (your home network)? If not, why was Port Forwarding created for port 22? Didn't Verizon question the need? They should have. I don't think Verizon would need any port forwarding to remotely assist you with their router. They have direct access to remote administration tools for that sort of thing usually, and they only access the router, not your network, let alone your Id.
Regardless, if you don't use SSH to access your Id from outside your network,
you should delete that Port Forwarding rule for port 22. I don't think there is any reason for JRiver to access the Id that way unless you ask for remote assistance. But in that case, the remote access password would be essential, and you could always add that port forwarding rule again when you request assistance. If someone helped you set up the Id, they could have set up that rule.
Once the intruder was on your Id, which means on your network, they could have been able to get to your Windows PC, and any other devices on your network. You should use the Antivirus Software on your Windows PC to do a thorough scan for everything, just to be sure.
You could have really dodged a bullet here, but the good news is that most of these intrusions are just kids, somewhere in the world, testing their skills and playing around with port scanning software they can download. If so they would have just had a look around to see if they could find something interesting. I think the fact you saw them using a Google search window means that they didn't find anything on the Id, and either couldn't get to your Windows PC or didn't find anything there. The fact that they were going to sites where you may have an account, and those accounts may be set to automatically log on, says that they were looking for a way to spend some of your money, by buying stuff for themselves using your accounts.
Do check your accounts for unknown transactions if you have a PayPal, Microsoft, or other accounts. If you had unsecured passwords on your Windows PC in a document or something, it would be worth changing them. If you do have internet banking accounts that log in automatically on your Windows PC, there is a VERY slim chance that the intruder could have logged into those accounts, but probably not done much harm. Again, change passwords for those accounts, and don't let any browser remember passwords for online banking or similar.
Disclaimer: I don't have an Id so I don't know exactly what services are running on it to accept an SSH connection. I am relying on my experience with other similar hardware.
