My Outlook account got hacked. E-mails leaked by IMAP automatic sync. How this happened?

Hi, 

The same happened to me, and i don't know what to do now.

 I started receiveing some scam emails to access other accounts, then, out of nowhere i started receiving information that somewhere someone tried to login to other acounts (even one's i did not remember i had).

 When i tried do login to those, i did not have a problem, but, for instance, ubisoft had a record and it showed many login from other countries. At this point i thought it was some data breach.

 Then i received a notification that my email had suspicious activity and when i checked it, it was happening already from the start of the month and MS only told me like 10 days after the first one.

 I did change my passwords and keep changing them but it weirdly keeps showing some logins or attempts from China or Malaysia or Azerbaijan. Countries where i've never been to and they don't even ask for the 2step autenthicator or warn me about this.

Any advises? Or any explanation? 

Also, Chrome told me today and yesterday that Outlook was not safe and people could be trying to access my information. Could it be redirecting the link or something?

My Outlook account got hacked. Have been using this e-mail  account from the early days of Hotmail. E-mails leaked by IMAP automatic sync despite using different password than on other sites and having two factor authentication activated.

Got warning SMS from Microsoft and when checking recent activity, i saw multiple "Successful Syncs" listed from countries like China, Thailand, Russia, Poland, Brazil, Ukraine, Philippines, Kazakhstan and Iran. These syncs took place in two different times in four hour intervals. How could this be possible? Why Microsoft detected that something fishy is going on but allowed sync to be completed anyway? Doesn't IMAP sync have some kind of location based checks in place like when logging in into other MS sites and services?

Since then, I have changed the password of my account, unlinked Skype from my Microsoft account, deleted any active app passwords.

I see again some IMAP syncs in my activity tab and they are now marked as "Unsuccessful". Small consolation knowing that your whole e-mail history is already leaked into some Chinese servers :(

How this all could have happened? Is there a security hole in Microsoft's IMAP sync implementation?

Me too, identical case like you 3 accounts yesterday

https://www.microsoft.com/en-us/microsoft-365/blog/2018/11/20/sign-in-to-your-microsoft-account-without-a-password-using-windows-hello-or-a-security-key/   and other other helpful information