My Outlook account got hacked. E-mails leaked by IMAP automatic sync. How this happened?

Anonymous

My Outlook account got hacked. Have been using this e-mail account from the early days of Hotmail. E-mails leaked by IMAP automatic sync despite using different password than on other sites and having two factor authentication activated.

Got warning SMS from Microsoft and when checking recent activity, i saw multiple "Successful Syncs" listed from countries like China, Thailand, Russia, Poland, Brazil, Ukraine, Philippines, Kazakhstan and Iran. These syncs took place in two different times in four hour intervals. How could this be possible? Why Microsoft detected that something fishy is going on but allowed sync to be completed anyway? Doesn't IMAP sync have some kind of location based checks in place like when logging in into other MS sites and services?

Since then, I have changed the password of my account, unlinked Skype from my Microsoft account, deleted any active app passwords.

I see again some IMAP syncs in my activity tab and they are now marked as "Unsuccessful". Small consolation knowing that your whole e-mail history is already leaked into some Chinese servers :(

How this all could have happened? Is there a security hole in Microsoft's IMAP sync implementation?

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

Anonymous

Dear Tech community,

as far as we know now, there was an UX issue on the MSA recent activity page, where a subset of unsuccessful IMAP syncs are erroneously shown as successful. This bug should be fixed in a couple of days and we hope that no one was ever compromised.

Cheers

Volker

P.S.: IP addresses are translating to countries like Bangladesh, Brasil, China etc. A hacker can simply fake their source IP, therefore it is difficult to say, where the hack attacks are coming from. Please just keep using security best practices for your hotmail/outlook accounts with difficult passwords to be changed as often as possible and leverage multi factor authentication.

https://www.microsoft.com/en-us/microsoft-365/blog/2018/11/20/sign-in-to-your-microsoft-account-without-a-password-using-windows-hello-or-a-security-key/

All other email providers have the same challenge to help their customers to secure their username/password authentications.

0 comments

224 additional answers

Anonymous

2019-10-15T03:28:32+00:00

Creating the 2-factor auth doesn't work, that is something Microsoft created to make people think their information is safe. Your account is not being hacked from all those countries. The individual who is doing it is using a program to change its IP address. It could even be your neighbor and he can change his location somewhere in Europe.
Was this answer helpful?

0 comments No comments
Anonymous

2019-10-15T01:37:42+00:00

I have the exact same issue!!

Microsoft has GOT to get on this issue and stop telling people to do the same **** over and over. Creating a new hotmail account and 2 factor auth is not doing it. Enough of these hacking attempt from countries other than the one I’m in. Is there no way to specify countries, states, or IP address to block? If someone From Germany shouldn’t be trying to access my account at all! At least give us the option to turn off access from other countries. If we want to go traveling we can turn it off in anticipation of the trip. Again at least make it an option available.
Was this answer helpful?

0 comments No comments
Anonymous

2019-10-15T00:00:12+00:00

I have the exact same issue!!
Was this answer helpful?

0 comments No comments
Anonymous

2019-10-11T15:35:57+00:00

I've the same problem! 😒
Was this answer helpful?

0 comments No comments