How did my email get hacked? What to do next?

Question

I use Hotmail. My password was strong (upper/lower case letters, digits, and special characters. No dictionary words.

It was only 8 characters, maybe that was the problem?

• I only use this password for my e-mail. Nothing else.

• I didn't receive or respond to any phishing emails.

• I checked news sites and there is no report of Hotmail itself being hacked.

• Malwarebytes and other scanners/tools I have claim my system is clean. No key loggers.

Does anyone have any thoughts on how my account could have been compromised?

They immediately changed the password, recovery questions, and recovery email. Then they sent spam asking my contacts for money (to be sent via Western Union). The IP address the mail appears to originate from seems to be a Nigerian IP block.

First, I don't understand how my password could have been gotten. When I tried guessing passwords, after five or six attempts it made me enter a CAPTCHA before each attempt.

Can people brute force Hotmail/MSN passwords?

Second, it doesn't appear that there is anything I can actually do. When I search online, all I find are tips to prevent being the victim of fraud (i.e. don't send money via Western Union) but I can't find any place to report the criminal(s).

Does such a place exist?

Finally, what steps can I take to prevent this in the future?

Answer 1

Hotmail can be bruteforced. And CAPTCHA is always being improved because it's always being broken. Also, sometimes companies have vulnerabilities they don't know about or don't acknowledge, etc. Basically what I'm trying to say is, even if you are very safe on the internet (as it sounds you are), your account can still be hacked.

One thing, however, many people over look is when and where they log into their accounts. It is best not to log into email and Facebook in places like the Apple store, on a Starbucks or McDonalds network, etc, as those computers and networks are "out in the open". As we saw with Sony recently, sometimes the big company won't even encrypt sensitive data before it starts sending it through the air. NEVER log into bank accounts from a public network.

Your account can also be compromised by someone cracking the password reset questions you set. Someone can use the forgotten password link to view these questions. If they are easy to guess or ones with common answers you are leaving your account wide open.

Notify your friends that you have been hacked, using Bcc. Notify Hotmail support. And probably, you will have to make a new account.

Answer 2

Getting e-mail passwords is incredibly easy. If you've ever logged into your e-mail on a public network (anywhere that isn't your house) then someone could get your password. They can use a packet sniffer or check the rounter logs. (you can actually do this on your own home network just to see how it works)

In order to prevent this from happening again, you need to make sure to only use ssl to log into your e-mail and it would be a good idea to use encrytion as well, like tor or a web proxy.

Answer 3

Although I have no idea how you can get it hacked, I can give you some suggestions on where to go from here:

1. Setup a new email account. I highly recommend Gmail, its very easy to use, and has lots of great features to add onto it. It can also be used to identify with many websites, such as StackExchange.
2. Anywhere that had your hotmail account as the contact email, change it to your new gmail.
3. Inform your friends. Although we like to think most people will not fall for a scam like this, it happens!
4. You could attempt to contact Hotmail and their Support, and try to get the account back, or have them remove it.

Answer 4

One of the basic mistake that a lot of people make is using the same password for all the sites that they have accounts on .
Now strong or not if you use your email-id and the same password as log-in credential for a lot of websites its a big red flag . Because not all websites encrypt your passwords when they store it (and since they make such a basic design flaw their site is generally not very secure ). When these sites get hacked the hackers have a list of email-ids and their passwords , and voila your email account gets compromised.