My Outlook account got hacked. E-mails leaked by IMAP automatic sync. How this happened?

I'd like to contribute to this thread that I recently encountered the same issue.

I was notified this past weekend of a log-in from a neighboring state, and when I saw similar "Successful Syncs" starting from the end of August, I locked down the account.

The previous password for my account was as strong alphanumeric password unique to the account and less than 2 years old.

The account alias was an @hotmail.com account that I've had since the late 90's. There are only four devices I ever access it from. 2 mobile devices, a work pc, and a personal PC. All those devices have relatively strong security, do not install software from untrusted sources, and use browsers with current security updates. I believe the last time I used the account for e-mail was around 2001 when the Hotmail e-mail access was shut down due to "inactivity".

Also of note was the fact that until a month ago I had never logged into Outlook.com to use the e-mail functionality of my MS account. I don't know if that factors into it, but I do find it noteworthy. Thankfully because of this I had (hopefully) nothing of note that could have been sync'd, although I do not know what there were able to access with the few minutes from a browser-based log-in. There were some XBox Live e-mails, spam, and apparently a Uber account someone had mistakenly signed up for using my e-mail (Uber e-mails were all in Spanish and addressed to someone else's name).

I don't know how long the sync's have been going on for since apparently we only get 28 days of history, but there doesn't appear to be any browser based log-in attempts outside of the one that triggered the alert e-mail. I don't see any failed log-in attempts in my history for that matter. Since I do not use my account for e-mail nothing should be attempting to sync via IMAP. What's also odd is that the sync attempts were typically 2-5 days apart. The earliest entry shows a successful pop3 sync which I find odd since according to the Outlook.com settings POP3 is disabled.

None of my other accounts with other services have had any suspicious activity.

I've since change the password, enabled 2fa, and switched the alias as well as disabled logging in for the previous alias.

While I understand MS wants us to use their services, I don't understand why we don't have an option to opt out here. It seems the IMAP sync attempts are a common theme in the thread and other posts here and I feel we should at the very least have the option to disable IMAP access to our accounts. It feels like we are having a possible security hole vector forced on us.

What we need is a whistleblower at Microsoft

Hey wideawakewesley,

I had same problem recently.  I'd gotten a generic warning from Microsoft that my Hotmail account MAY have been compromised.  On the surface, everything looked OK.  Like you I have a double-digit strong password. I have spybot installed on top of Windows Defender.  Neither spotted anything.

I spent hours on Chat with numerous Microsoft people.  One showed me how to check recent activity and that's when I spotted an IMAP intrusion with a successful sync. Was told it happened because my account is linked to an app that was compromised.  I purposely link to no apps but was told that my Skype account is linked by default to my Microsoft account.  I rarely use Skype.  Unfortunately, Skype account cannot be delinked.  Also, Skype account cannot be closed without closing the Microsoft account. 

The chat session folks could offer me no fix other than the standard change the password which I'd already done.  They couldn't even make a report of this hack and told me that I had to make a post on the support and/or community forum.

To make matters worse, the Windows Defender and Spybot provided no protection because the hack happened outside of my laptop or PC. 

I agree with you that Microsoft is not being totally transparent about this problem.

Microsoft needs to address this problem ASAP!!

This is clearly a massive security hole by Microsoft. Last night I also got the email telling me I needed to change my password as my account has been compromised. I changed password and then checked the logs. My account successfully synced with IMAP from Brazil!!!! Then checking, successfully synced from India 2 days ago with IMAP again. Further back I have a successfully synced from Belarus over a month ago and now Microsoft suddenly a month later think it is a good idea to let me know my account has been compromised and obviously using IMAP that means whoever has been able to use IMAP to connect to my account  has downloaded a copy of my hotmail account that I have had for over 15 years. This is unacceptable that Microsoft doesnt block IMAP connections from random locations around the world.