My Outlook account got hacked. E-mails leaked by IMAP automatic sync. How this happened?

Anonymous
2017-12-27T07:24:23+00:00

My Outlook account got hacked. Have been using this e-mail  account from the early days of Hotmail. E-mails leaked by IMAP automatic sync despite using different password than on other sites and having two factor authentication activated.

Got warning SMS from Microsoft and when checking recent activity, i saw multiple "Successful Syncs" listed from countries like China, Thailand, Russia, Poland, Brazil, Ukraine, Philippines, Kazakhstan and Iran. These syncs took place in two different times in four hour intervals. How could this be possible? Why Microsoft detected that something fishy is going on but allowed sync to be completed anyway? Doesn't IMAP sync have some kind of location based checks in place like when logging in into other MS sites and services?

Since then, I have changed the password of my account, unlinked Skype from my Microsoft account, deleted any active app passwords.

I see again some IMAP syncs in my activity tab and they are now marked as "Unsuccessful". Small consolation knowing that your whole e-mail history is already leaked into some Chinese servers :(

How this all could have happened? Is there a security hole in Microsoft's IMAP sync implementation?

Outlook | Web | Outlook.com | Account management, security, and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Anonymous
2019-10-19T13:55:26+00:00

Dear Tech community,

as far as we know now, there was an UX issue on the MSA recent activity page, where a subset of unsuccessful IMAP syncs are erroneously shown as successful. This bug should be fixed in a couple of days and we hope that no one was ever compromised.

Cheers

Volker

P.S.: IP addresses are translating to countries like Bangladesh, Brasil, China etc. A hacker can  simply fake their source IP, therefore it is difficult to say, where the hack attacks are coming from. Please just keep using security best practices for your hotmail/outlook accounts with difficult passwords to be changed as often as possible and leverage multi factor authentication.

https://www.microsoft.com/en-us/microsoft-365/blog/2018/11/20/sign-in-to-your-microsoft-account-without-a-password-using-windows-hello-or-a-security-key/

All other email providers have the same challenge to help their customers to secure their username/password authentications.

Was this answer helpful?

10+ people found this answer helpful.
0 comments

224 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2021-03-31T03:41:01+00:00

    The issue isn't just that hacking happened and the system let folks in an entirely different country, from a location you have never logged into before, connect (and they don't do anything bout multiple attempts from all over) it is that if they do connect, Microsoft has no way for you to force them to disconnect.    It isn't too much of a worry that folks are trying but failing to connect as they are failing. But even that, where your account is being logged into from all over the world, still shouldn't even get that far. 

    You can change your password and turn on two factor authentication but that doesn't disconnect them.   The only thing they have is a button that says it can take 24 hours to disconnect everyone and it won't even do it for everything (xbox is listed). 

    24 HOURS where a hacker can do whatever they want with your email and with requesting password resets from every site they can find in your email and work on identity theft.  24 HOURS!!!!!!!

    Seriously, if you have an outlook account strongly consider switching to GMAIL where they will disconnect all connections immediately or a private email account.

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  2. Anonymous
    2020-04-02T01:57:28+00:00

    Why is it that when I go to my student house one city over my account gets locked, but when people connect from other countries nothing happens.

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  3. Anonymous
    2019-11-27T05:38:04+00:00

    Hi Volker, 

        I have been receiving multiple emails on my outlook account that unusual activity has been detected. As I reviewed my recent activity, there has been multiple successful logins for IMAP requests by the same IP address. Doing a quick search it has said it was from the Microsoft Azure Data Office in Cheyenne, Wyoming however I do not know if this due to the fact the hacker faked the source of the IP address or there has been a data breach? I would like to know how I can secure my account as I have been receiving these emails daily. Also, I have been receiving ransomware emails under the subject "I recorded you ****" which mentions my password  which I am unaware of how that information has been made available. If anyone has any helpful answers, I would really appreciate it!

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  4. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

    Comments have been turned off. Learn more