Why hack into a Microsoft account?

Sicard

Hi

I've just had alerts of attempts t6o hack into mine, one from Ghana and two from Afghanistan. But I don't get why? There's no personal stuff of any use and no cards.

booneruk

They cast a wide net, try to automate these things and every now and again they might find something they can use to exploit something

This kind of thing is just the 'noise' you have to put up with by using mainstream services online. Ensure your passwords are secure, not shared between services and enable MFA etc wherever you can.

born_again

Some do. Hacking one account can lead to details that allow hacking of other accounts.

flaneurs_lobster

There's a bit of your account on Microsoft where you can view the penetration attempts against your account (as in someone trying passwords against your Hotmail/Outlook login). I get dozens a day, they'll be automated bots running down lists of known email accounts.

As to why, if they were to get access they would hope to control your linked email account (change the password) and then use that to instigate "I've lost my password" at places where you have accounts and either transfer money or order high-value goods.

Particularly important would be getting into your mobile account and maybe instigating SIM swap - can be done in little time if they swap to eSIM.

It's why all that boring stuff about different, long, complicated passwords, 2FA and passkeys is quite important.

Neil_Jones

https://forums.moneysavingexpert.com/discussion/6672082/why-hack-into-a-microsoft-account

Hotmail/Outlook used to be the biggest free email provider, and it is probably the oldest one, launching in 1996 and being bought by Microsoft a year or so later.

Because of its popularity (since surpassed by Gmail) you can pretty much stick anything you like in front of "at hotmail.com (or at outlook.com most probably) and it will almost certainly match an existing account

To answer the question its more to see whether it provides access to key online services if its got an easy access password. The easy solution to this is not to use a password (so there's nothing to compromise) and make use of authenticators:

https://support.microsoft.com/en-us/accounts-billing/security/how-to-go-passwordless-with-your-microsoft-account

Similar solutions exist for Yahoo and Gmail, in fact Gmail freaks the crap out every time it thinks my account has been signed into what it thinks is a new computer, and I get more notifications and emails than I know what to do with, in addition to the original two factor request when I started the sign-in request!

flaneurs_lobster

Similar solutions exist for Yahoo and Gmail, in fact Gmail freaks the crap out every time it thinks my account has been signed into what it thinks is a new computer, and I get more notifications and emails than I know what to do with, in addition to the original two factor request when I started the sign-in request

I registered a new domain and routed the email to a Gmail account this week. Must have been a dozen warnings to primary and backup email addresses issued.

forgotmyname

All the options from various websites and devices that offer sign in with your google account or microsoft account
plus many people will have one drive linked to it, some may not realise they are even using one drive.

A few MS services have been compromised recently, not an issue for most but if you use github then then you
may have what they are looking for?

Vitor

That hackers don't know the value until you've been powned

PRAISETHESUN

https://forums.moneysavingexpert.com/discussion/comment/82031447#Comment_82031447

And the end user often doesn't realise the value of their "worthless" account until it gets compromised and the damage starts…