My Outlook account got hacked. E-mails leaked by IMAP automatic sync. How this happened?

Anonymous
2017-12-27T07:24:23+00:00

My Outlook account got hacked. Have been using this e-mail  account from the early days of Hotmail. E-mails leaked by IMAP automatic sync despite using different password than on other sites and having two factor authentication activated.

Got warning SMS from Microsoft and when checking recent activity, i saw multiple "Successful Syncs" listed from countries like China, Thailand, Russia, Poland, Brazil, Ukraine, Philippines, Kazakhstan and Iran. These syncs took place in two different times in four hour intervals. How could this be possible? Why Microsoft detected that something fishy is going on but allowed sync to be completed anyway? Doesn't IMAP sync have some kind of location based checks in place like when logging in into other MS sites and services?

Since then, I have changed the password of my account, unlinked Skype from my Microsoft account, deleted any active app passwords.

I see again some IMAP syncs in my activity tab and they are now marked as "Unsuccessful". Small consolation knowing that your whole e-mail history is already leaked into some Chinese servers :(

How this all could have happened? Is there a security hole in Microsoft's IMAP sync implementation?

Outlook | Web | Outlook.com | Account management, security, and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Anonymous
2019-10-19T13:55:26+00:00

Dear Tech community,

as far as we know now, there was an UX issue on the MSA recent activity page, where a subset of unsuccessful IMAP syncs are erroneously shown as successful. This bug should be fixed in a couple of days and we hope that no one was ever compromised.

Cheers

Volker

P.S.: IP addresses are translating to countries like Bangladesh, Brasil, China etc. A hacker can  simply fake their source IP, therefore it is difficult to say, where the hack attacks are coming from. Please just keep using security best practices for your hotmail/outlook accounts with difficult passwords to be changed as often as possible and leverage multi factor authentication.

https://www.microsoft.com/en-us/microsoft-365/blog/2018/11/20/sign-in-to-your-microsoft-account-without-a-password-using-windows-hello-or-a-security-key/

All other email providers have the same challenge to help their customers to secure their username/password authentications.

Was this answer helpful?

10+ people found this answer helpful.
0 comments

224 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

    Comments have been turned off. Learn more

  2. Anonymous
    2019-08-02T14:53:43+00:00

    I am having the EXACT SAME ISSUE.

    I got legit hacked in July. Someone got my info, used it to get into my bank acct, and attempted to get money.

    I changed my passwords - and they still tried. It showed "unsuccessful sync".

    I went ahead and updated all of my passwords again. Now all of the previous "unsuccessful syncs" have changed and show SUCCESSFUL.

    Why. Why would they auto sync all of my **** to a hacker in Tanzania, when I am in the US. Why would it auto sync AFTER I change my password.

    Was this answer helpful?

    0 comments
  3. Anonymous
    2019-07-31T12:51:39+00:00

    my bank account was hacked ,WalMart money debit card , my card was froze the account was froze Lose litigation is looking into it but sent back 500.00 and 100.00 it not yet i don't have to pay that back .I had to transfer money to my paypal  account to pay bills for two months i scrapped by .Mortgage late fees for two months 961.72 i be glad to send it to them the account was closed and i had to open other one .Since then i get calls all day from the F scammers really sick of it

    Was this answer helpful?

    0 comments
  4. Anonymous
    2019-07-30T00:51:11+00:00

    My account got hacked ,not saying but think i no who is behind it . Facebook just about every person in Thailand works for Facebook and do i have proof ,yes i got about 10 page report of hackers ,cyber hackers ,it didn't happen until i deactivated my account . You would not believe the people running behind your Facebook page. And Microsoft is just as guilty for letting this happen and to   sync my information , The Sync part of Android syncs things such as Documents, Contacts, and other things to services such as Facebook, Google, Ubuntu One... ... The "Auto Sync" feature can be changed from Settings > Accounts and Sync... That setting basically means that it will sync your device with the service's servers, Protocol: IMAP

    IP: 101.109.72.178

    Account alias:

    Time: 7/18/2019 3:37 PM

    Approximate location: Thailand

    Type: Successful sync

    You've secured your account since this activity occurred.

    Learn about more ways you can protect your account. i hate to say it but this pisses me off Microsoft ,Bill Gates you let it happen you own Microsoft that security breach of personal information

    Was this answer helpful?

    0 comments