My Outlook account got hacked. E-mails leaked by IMAP automatic sync. How this happened?

Anonymous
2017-12-27T07:24:23+00:00

My Outlook account got hacked. Have been using this e-mail  account from the early days of Hotmail. E-mails leaked by IMAP automatic sync despite using different password than on other sites and having two factor authentication activated.

Got warning SMS from Microsoft and when checking recent activity, i saw multiple "Successful Syncs" listed from countries like China, Thailand, Russia, Poland, Brazil, Ukraine, Philippines, Kazakhstan and Iran. These syncs took place in two different times in four hour intervals. How could this be possible? Why Microsoft detected that something fishy is going on but allowed sync to be completed anyway? Doesn't IMAP sync have some kind of location based checks in place like when logging in into other MS sites and services?

Since then, I have changed the password of my account, unlinked Skype from my Microsoft account, deleted any active app passwords.

I see again some IMAP syncs in my activity tab and they are now marked as "Unsuccessful". Small consolation knowing that your whole e-mail history is already leaked into some Chinese servers :(

How this all could have happened? Is there a security hole in Microsoft's IMAP sync implementation?

Outlook | Web | Outlook.com | Account management, security, and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Anonymous
2019-10-19T13:55:26+00:00

Dear Tech community,

as far as we know now, there was an UX issue on the MSA recent activity page, where a subset of unsuccessful IMAP syncs are erroneously shown as successful. This bug should be fixed in a couple of days and we hope that no one was ever compromised.

Cheers

Volker

P.S.: IP addresses are translating to countries like Bangladesh, Brasil, China etc. A hacker can  simply fake their source IP, therefore it is difficult to say, where the hack attacks are coming from. Please just keep using security best practices for your hotmail/outlook accounts with difficult passwords to be changed as often as possible and leverage multi factor authentication.

https://www.microsoft.com/en-us/microsoft-365/blog/2018/11/20/sign-in-to-your-microsoft-account-without-a-password-using-windows-hello-or-a-security-key/

All other email providers have the same challenge to help their customers to secure their username/password authentications.

Was this answer helpful?

10+ people found this answer helpful.
0 comments

224 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2018-09-18T14:35:19+00:00

    According to MS non of my accounts were compromised despite the activity log showing as 'successful sync' after a password change, however they've not supplied any detail beyond that so I am still monitoring more frequently than usual. I've not seen anything of concern after six months from the first notification so I m fairly sure that the problem is a fault in the report but it can't be guaranteed at the moment.

    For me its significant that the only 'successful sync' are before the password change and everything since has been unsuccessful; that lends some credence to MS assertion that nothing was actually compromised - I would expect to see one or two 'unsuccessful' before the password change if the reporting were accurate.

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  2. Anonymous
    2018-09-18T12:09:00+00:00

    That's similar to what I was seeing and after investigation the back office team said the 'successful' entries were in fact 'unsuccessful' but the reporting page was giving incorrect information. Since they looked at it (and I setup a new password just in case) there have been no 'successful' sync and the previously 'successful' ones appearing in the log now say 'unsuccessful'. Without some detail of what's changed and why the 'compromise' email was triggered I am not 100% convinced that I've not lost data but, so far, I've not appeared on haveIbeenpwned more than the ones that I was already aware of

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  3. Anonymous
    2018-09-17T22:37:35+00:00

    This will sound like typical MS fake-out but:...

    As a result of this thread I've exchanged a few emails with the outlook back office support team, they think, and are trying to prove, that the automated IMAP Sync which are appearing in the log as 'Successful' is a fault in the reporting page which changes the status to Successful after account details have been changed (I'm going to test this at next password change) , they've checked all the ones I supplied and assured me that non of them actually led to information leaving my account. They haven't yet said why the notifications come when they do but the timing would indicate that they are not connected to the IMAP sync. It's still not satisfactory but I am a little reassured that data has not actually been compromised.

    I never got that indication from any support.   I was calling in and using the web support frantically.   One support rep actually told me to just to relax and not worry about it?  I was boiling upset.   So your saying that even though there were entries showing successful it didn't actually transfer?  I've had this MSN account for decades and I don't want to change it.     The entries below show unsuccessful  but before the entries were successful.   If anyone could explain further what these entries mean, that would be super helpful.  I mean what do you do with these entries.   It's happening nonstop.

    Protocol: IMAP

    IP: 121.128.142.188

    Account alias: 

    ******@msn.com

    Time: 11 hours ago

    Approximate location: Korea

    Type: Unsuccessful sync

    Look unfamiliar?

    Secure your account

    Protocol: IMAP

    IP: 14.207.1.74

    Account alias: 

    ******@msn.com

    Time: Yesterday 1:07 PM

    Approximate location: Thailand

    Type: Unsuccessful sync

    Look unfamiliar?

    Secure your account

    Protocol: IMAP

    IP: 88.83.244.19

    Account alias: 

    ******@msn.com

    Time: 8/30/2018 8:33 AM

    Approximate location: Czechia

    Type: Unsuccessful sync

    Look unfamiliar?

    Secure your account

    Protocol: IMAP

    IP: 170.82.79.1

    Account alias: 

    ******@msn.com

    Time: 8/28/2018 6:13 AM

    Approximate location: Brazil

    Type: Unsuccessful sync

    Look unfamiliar?

    Secure your account

    Protocol: SMTP

    IP: 170.246.237.170

    Account alias: 

    ******@msn.com

    Time: 8/22/2018 3:47 AM

    Approximate location: Brazil

    Type: Unsuccessful sync

    Look unfamiliar?

    Secure your account

    Protocol: SMTP

    IP: 200.189.15.67

    Account alias: 

    ******@msn.com

    Time: 8/22/2018 3:47 AM

    Approximate location: Brazil

    Type: Unsuccessful sync

    Look unfamiliar?

    Secure your account

    Protocol: IMAP

    IP: 201.208.123.33

    Account alias: 

    ******@msn.com

    Time: 8/22/2018 1:03 AM

    Approximate location: Venezuela

    Type: Unsuccessful sync

    Look unfamiliar?

    Secure your account

    Protocol: SMTP

    IP: 177.130.136.197

    Account alias: 

    ******@msn.com

    Time: 8/21/2018 11:22 PM

    Approximate location: Brazil

    Type: Unsuccessful sync

    Look unfamiliar?

    Secure your account

    Protocol: SMTP

    IP: 186.216.70.140

    Account alias: 

    ******@msn.com

    Time: 8/21/2018 11:22 PM

    Approximate location: Brazil

    Type: Unsuccessful sync

    Look unfamiliar?

    Secure your account

    Protocol: IMAP

    IP: 200.84.122.157

    Account alias: 

    ******@msn.com

    Time: 8/21/2018 7:45 PM

    Approximate location: Venezuela

    Type: Unsuccessful sync

    Look unfamiliar?

    Secure your account

    Protocol: IMAP

    IP: 83.252.237.184

    Account alias: 

    ******@msn.com

    Time: 8/21/2018 7:01 PM

    Approximate location: Sweden

    Type: Unsuccessful sync

    Look unfamiliar?

    Secure your account

    Protocol: SMTP

    IP: 177.67.164.5

    Account alias: 

    ******@msn.com

    Time: 8/21/2018 6:40 PM

    Approximate location: Brazil

    Type: Unsuccessful sync

    Look unfamiliar?

    Secure your account

    Protocol: IMAP

    IP: 114.16.77.160

    Account alias: 

    ******@msn.com

    Time: 8/21/2018 6:23 PM

    Approximate location: Japan

    Type: Unsuccessful sync

    Look unfamiliar?

    Secure your account

    Protocol: SMTP

    IP: 200.23.231.179

    Account alias: 

    ******@msn.com

    Time: 8/21/2018 1:02 PM

    Approximate location: Brazil

    Type: Unsuccessful sync

    Look unfamiliar?

    Secure your account

    Protocol: SMTP

    IP: 168.0.225.24

    Account alias: 

    ******@msn.com

    Time: 8/21/2018 1:02 PM

    Approximate location: Brazil

    Type: Unsuccessful sync

    Look unfamiliar?

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  4. Anonymous
    2018-08-18T22:32:25+00:00

    What we need is a whistleblower at Microsoft

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments