My Outlook account got hacked. E-mails leaked by IMAP automatic sync. How this happened?

Anonymous
2017-12-27T07:24:23+00:00

My Outlook account got hacked. Have been using this e-mail  account from the early days of Hotmail. E-mails leaked by IMAP automatic sync despite using different password than on other sites and having two factor authentication activated.

Got warning SMS from Microsoft and when checking recent activity, i saw multiple "Successful Syncs" listed from countries like China, Thailand, Russia, Poland, Brazil, Ukraine, Philippines, Kazakhstan and Iran. These syncs took place in two different times in four hour intervals. How could this be possible? Why Microsoft detected that something fishy is going on but allowed sync to be completed anyway? Doesn't IMAP sync have some kind of location based checks in place like when logging in into other MS sites and services?

Since then, I have changed the password of my account, unlinked Skype from my Microsoft account, deleted any active app passwords.

I see again some IMAP syncs in my activity tab and they are now marked as "Unsuccessful". Small consolation knowing that your whole e-mail history is already leaked into some Chinese servers :(

How this all could have happened? Is there a security hole in Microsoft's IMAP sync implementation?

Outlook | Web | Outlook.com | Account management, security, and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Anonymous
2019-10-19T13:55:26+00:00

Dear Tech community,

as far as we know now, there was an UX issue on the MSA recent activity page, where a subset of unsuccessful IMAP syncs are erroneously shown as successful. This bug should be fixed in a couple of days and we hope that no one was ever compromised.

Cheers

Volker

P.S.: IP addresses are translating to countries like Bangladesh, Brasil, China etc. A hacker can  simply fake their source IP, therefore it is difficult to say, where the hack attacks are coming from. Please just keep using security best practices for your hotmail/outlook accounts with difficult passwords to be changed as often as possible and leverage multi factor authentication.

https://www.microsoft.com/en-us/microsoft-365/blog/2018/11/20/sign-in-to-your-microsoft-account-without-a-password-using-windows-hello-or-a-security-key/

All other email providers have the same challenge to help their customers to secure their username/password authentications.

Was this answer helpful?

10+ people found this answer helpful.
0 comments

224 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2019-08-07T14:14:14+00:00

    0

    From what I can see, yes your emails have been compromised. If you look at the log you notice that it has synchronised IMAP - This suggests that the client has downloaded your email settings, folders and all of the emails contained In those folders.changing password won't work ,they no your new password and change their location on their IP address to look like it from your location ,they are not Hackers but cyber Hackers that can follow you me or who ever got Hacked . they can follow all your messages and your banking messages and my guess that what they are after . deleting outlook would not do no good and Microsoft knows that because they are in your Folders ,Hard Drive ,Operating system . When this happens to bigger people like Bill Gates or big companies they reset everything from  in the system . and some have new Hardware installed ,like a new Hard drive that why it cost up in millions  for companies.I got a ten page profile from Hackers and cyber hackers that are on Facebook and who  is friends ,Microsoft ,Bill Gates And Mark Zuckerberg not saying they are connected on this  but it really strange

    Was this answer helpful?

    0 comments
  2. Anonymous
    2019-08-07T13:41:17+00:00

    I also have the same problem. It all started when I received an e-mail from Microsoft saying that there was some unusual activity in my account. Once I checked this information, I found out that there were login attempts from Czechia, Brazil, Ukraine, Burkina Faso, Vietnam, Iran and India. I already changed my password but if this problem continues I will delete my e-mail account and start using my gmail account.

    Was this answer helpful?

    0 comments
  3. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

    Comments have been turned off. Learn more

  4. Anonymous
    2019-08-06T23:06:26+00:00

    I have deleted my account because I know it's been hacked. 

    1.  I've been receiving a **** of spam emails.

    2.  Some **** is sending emails from my account. Someone sent email messages using my email address as the From address, making it appear to recipients that they came from me.

    1. 2 failed login attempts from Egypt and Vietnam. 

    What annoys me is I've got to wait 60 days for my account to be deleted.

    Was this answer helpful?

    0 comments