My Outlook account got hacked. E-mails leaked by IMAP automatic sync. How this happened?

Anonymous
2017-12-27T07:24:23+00:00

My Outlook account got hacked. Have been using this e-mail  account from the early days of Hotmail. E-mails leaked by IMAP automatic sync despite using different password than on other sites and having two factor authentication activated.

Got warning SMS from Microsoft and when checking recent activity, i saw multiple "Successful Syncs" listed from countries like China, Thailand, Russia, Poland, Brazil, Ukraine, Philippines, Kazakhstan and Iran. These syncs took place in two different times in four hour intervals. How could this be possible? Why Microsoft detected that something fishy is going on but allowed sync to be completed anyway? Doesn't IMAP sync have some kind of location based checks in place like when logging in into other MS sites and services?

Since then, I have changed the password of my account, unlinked Skype from my Microsoft account, deleted any active app passwords.

I see again some IMAP syncs in my activity tab and they are now marked as "Unsuccessful". Small consolation knowing that your whole e-mail history is already leaked into some Chinese servers :(

How this all could have happened? Is there a security hole in Microsoft's IMAP sync implementation?

Outlook | Web | Outlook.com | Account management, security, and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Anonymous
2019-10-19T13:55:26+00:00

Dear Tech community,

as far as we know now, there was an UX issue on the MSA recent activity page, where a subset of unsuccessful IMAP syncs are erroneously shown as successful. This bug should be fixed in a couple of days and we hope that no one was ever compromised.

Cheers

Volker

P.S.: IP addresses are translating to countries like Bangladesh, Brasil, China etc. A hacker can  simply fake their source IP, therefore it is difficult to say, where the hack attacks are coming from. Please just keep using security best practices for your hotmail/outlook accounts with difficult passwords to be changed as often as possible and leverage multi factor authentication.

https://www.microsoft.com/en-us/microsoft-365/blog/2018/11/20/sign-in-to-your-microsoft-account-without-a-password-using-windows-hello-or-a-security-key/

All other email providers have the same challenge to help their customers to secure their username/password authentications.

Was this answer helpful?

10+ people found this answer helpful.
0 comments

224 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2019-01-06T00:49:33+00:00

    Same thing here. I used a strong 15 char password on this account and only this account, and some how I got successful sync from around the world.  I noticed there were no log in attempts associated with these syncs, either successful or unsuccessful attemps. These guy might be using some sort of applications authentication bypass or exploit for these syncs.  I wish Microsoft would come online an warn users and then take action to prevent it from happening again.

    Was this answer helpful?

    2 people found this answer helpful.
    0 comments
  2. Anonymous
    2018-11-17T18:45:35+00:00

    I have the exact same problem i managed to track down how it happend to me. it was during the fortnight leak of accounts. i had to change all my passwords across all platforms and devices. i still get attempts daily to get in here and syncs.

    I never was notified of it i noticed on my own because of failed attempts on other account a game account that notified me the second it happend...

    I never used a vpn...

    Getting someone of support to speak is imposible. 

    We cant do nothing to stop this.

    We cant disable the imap we cant limit login or syncs to just our country.

    <Removed Profanity> strong password and never get any sensible information by mail.

    Thanks Microsoft for giving my emails to some scum bag somewhere in the world.

    This tread will never get an oficial answer.

    My yahoo account got compromised because of this and <Removed Profanity>

    Actually that may be the solution...

    Just use yahoo for work mails and sensible things.

    good luck guys and gals i hope MC get their <Removed Profanity> straight. any kind of answer would be welcome from any oficial source...

    <Moderator removed Profanity>

    <Please read the Code of Conduct Please Do and Please Don't section. There are 13 year old members in this community and we ask that you respect this.>

    Was this answer helpful?

    2 people found this answer helpful.
    0 comments
  3. Anonymous
    2018-08-08T09:48:47+00:00

    I have sent you a private message requesting more information.

    Hi Tyler 

    I have the same issue - is there a problem?

    Thanks

    Reg

    Was this answer helpful?

    2 people found this answer helpful.
    0 comments
  4. Anonymous
    2018-08-06T08:41:35+00:00

    I spoke to Microsoft support and they claim that those IMAP syncs were done by me via VPN as well.

    I do use a VPN occasionally for my work laptop but I haven't managed to verify if the dates matched.

    Was this answer helpful?

    2 people found this answer helpful.
    0 comments