I have had my Microsoft account ever since Hotmail boomed, and I've had the same super weak six character password up until this year, but it was when one of my google accounts got compromised a few months ago that I decided to check my Microsoft account activity. I was surprised to see that it had registered activity that preceded from 2015 from countries I've never been in, so it was that moment when I made some changes.
I changed the password of every single account on every platform that I used to super lengthy ones with different kinds of character, and after reading on strong passwords, all of them focused on being especially lengthy. I also upped every security measure, adding recovery emails for my most important accounts and phone notifications to nearly all of them.
Then this morning happened. This morning I got a text and an email from Microsoft saying that someone else MAY be using my account and a link to review my activity. I was at work so I left the notification there to check it out later, but about half an hour later I got another text and email saying that my password has been compromised and a link to change my password. I didn't click it right away, I instead tried logging in to check my activity and it made me change my password and offered me to update my security info, which I did, and then I was prompted to log in again, and when I did it asked me to choose between sending a code to my recovery email or sending it through a text (like always after I upped my security).
After I logged in successfully I confirmed that there was unusual activity, as apparently an automatic sync (I don't ever use Microsoft apps, or any app for that matter, only web, even on my phone) from Russia. I refreshed the page because this activity was showing above my last activity (even though it's supposed to show chronologically) and after it was shown correctly I clicked on the arrow beside the activity to see the details again and was I again for a surprise.
The details showed activity from different dates from a small array of different countries none of which are where I live and all of them were automatic syncs. I double checked the rest of the activity and all of them were successful logins all made by me. All of these syncs were successful according to the details and the first one was from late July (last month).
Here's the data, skip if you want:
Protocol: POP3 IP: 188.8.131.52 Account alias: Time: 3 hours ago Approximate location: Russia Type: Successful sync You've secured your account since this activity occurred. Learn about more ways you can protect your account. Protocol: IMAP IP: 184.108.40.206 Account alias: ---@hotmail.com Time: 8/13/2017 2:22 AM Approximate location: Denmark Type: Successful sync You've secured your account since this activity occurred. Learn about more ways you can protect your account. Protocol: POP3 IP: 220.127.116.11 Account alias: ---@hotmail.com Time: 8/12/2017 11:00 AM Approximate location: Pakistan Type: Successful sync You've secured your account since this activity occurred. Learn about more ways you can protect your account. Protocol: IMAP IP: 18.104.22.168 Account alias: ---@hotmail.com Time: 7/27/2017 12:12 AM Approximate location: Brazil Type: Successful sync You've secured your account since this activity occurred. Learn about more ways you can protect your account.
How was my account compromised? Who was at fault for this breach? Me or Microsoft? I have my phone on 24/7 and email notifications at all times, how could this happen without my notice? Am I missing something or is this a vulnerability on Microsoft's system? How can I prevent this from happening again?