Got hacked by a rambler.ru account

Yes, Sasha, that email indicates the person, or more likely bot, that took over your account had already managed to acquire and use whatever password and other security verification method(s) were breached or collected in order to receive that email providing access to managing the account.

That's not the question, you've established you lost control of the account. The only question that remains to be answered is how they got access to most likely the password, as well as at least one other form of verification in order to be allowed to generate that message, since the password alone has never been enough.

It may not ever be possible to confirm this with any certainty, but it's critical that you understand how the account might have been breached in order to ensure you're protecting your new one. If your password was relatively short and especially simple, like a word or two, that alone could have allowed that to be breached, but duplicate passwords used on other websites that were breached, along with malware on your personal systems are possibilities as well.

As for the other form of verification, it's less likely they managed to directly breach a phone number or text, though if you ever responded to a supposed text message sent by Microsoft or provided this information to a 3rd party, those are common ways these are acquired from the account owner himself. Easier though is to acquire access to an alternate email account that's not as well protected, like a cable or similar email address that was included in the list of optional verification methods for your original account.

My own verification methods including the wireless company personal account that provides access to my smartphone information, as well as my alternate email account, all include 2-factor (2-Step in Microsoft terminology) authentication. Meaning you'd need 2 forms of identification typically including the password as the first, so the password can never be used alone and is never the same on any of these sites as any other, as well as relatively complex with no simple words or other easily hacked patterns.

Only you can determine what combination of less well secured verification method(s) may have been used to hack that older account, since only you know the answers to these questions, if anyone. In some cases, it's not possible to know how your password was acquired, but understanding the risks lets you better create and protect this in the future to avoid it ever happening again.

Note that I'm a past computer administrator and security professional who worked for and with computer, education and other major corporate customers, so I have a background in dealing with these issues for hundreds or thousands of users for over 40 years. In that time, I've seen all sorts of things, but typically my greatest problem was the employees, students and personal users of the devices themselves, since they've always been the easiest way to breach any system or account.

Rob

----- Original Message -----

From:  "Microsoft (do not reply)" <maccount@microsoft.com> To: <###########@#####.au>

Sent: Thu, 13 Apr 2023 07:09:41 -0700

Subject: Here's the link that you requested

Note the different time zones

Sasha Jones,

Since there's simply no way from what I've read to get back a Microsoft account that's had the primary alias renamed, deleted and all of the associated verification information changed, I think the primary item of interest at this point should be to try and understand how that happened in order to avoid it in the future.

One obvious way is to never get another Microsoft or any other account, since if you can't determine how it happened, the failure is likely to be repeated. It seems from your list that you had the Microsoft Authenticator installed, but I don't understand listing the "main Authenticator account" and main Microsoft account" separately, since these would typically be the same thing?

Though there have been complex hacks using tokens, I suspect that most personal account hacks are much simpler combinations of a breached, brute forced or phished password along with possibly a less secure verification email from someplace like a cable company or other less secure provider who doesn't offer or simply didn't have 2-factor authentication enabled. The other common method has been gamers who've downloaded either cracks, cheats or mods for games, all of which virtually always contain malware and would have provided a hacker with everything they need to bypass 2-Step (2FA) authentication.

Though I believe Microsoft and Google should have either worked faster to provide more secure methods of authentication and/or worked harder to explain these relatively complex issues to their customers, I do understand why this may not have been possible several months ago, since many of the improvements to these systems weren't available at that time.

So, this isn't an excuse, simply an explanation of reality in hopes that some might spend the time necessary to better protect their own accounts, since the bad actors are no longer script kiddies, but rather nation states who are obviously making big money or getting other value out of acquiring existing accounts, personal or business.

Rob