[ad_1]
By CCN: Hackers infiltrated Microsoft Outlook email users’ accounts in order to steal crypto, including bitcoin. The scope of the cyber-theft is still as-yet undetermined, but it appears to be more expansive than first thought.
One victim is Dutch engineer Jevon Ritmeester, who says a hacker gained access to Microsoft customer support workers’ login credentials.
The hacker used this information to pore through Ritmeester’s Outlook emails to reset passwords and withdraw bitcoin from his accounts on cryptocurrency exchanges.
Ritmeester is furious at Microsoft’s casual reaction to this egregious negligence.
Crypto theft was apparent motive for hacks
So far, Ritmeester says he only lost one bitcoin (roughly equivalent to $5,200 using today’s bitcoin price).
“The hackers also had access to my inbox, allowing them to password-reset my Kraken account and withdrawal [sic] my bitcoin,” Ritmeester told Motherboard via email.
Ritmeester says the hackers devised a forwarding protocol so that anytime one of his emails mentioned the word “Kraken,” his Microsoft Outlook would automatically forward that email to a secret Gmail account controlled by the hackers.
Ritmeester recounted what happened on the tech forum Tweakers, where he lamented that he’ll probably never recover his stolen bitcoin.
Engineer Jevon Ritmeester says hackers stole his bitcoin by infiltrating his Microsoft Outlook email account. | Source: screenshot
Victim: ‘Crypto users were targeted’
Other victims have also come forward to recount their harrowing experiences.
A Reddit user called Shinratechlabs says he lost “25,000 in crypto,” as a result of the Microsoft data breach, but did not provide further details. He’s disgusted at how easy it was for a hacker to illegally gain control of his Microsoft account.
“Lost 25,000 in crypto. Hackers didn’t have my credentials. They just had access to the content of my emails. Didn’t need passwords. Just put in password change requests. Verified the email confirmation links. Any confirmation they needed they had access to.”
“Strange New IP [Internet Protocol]. Click. New password? Sure? Click. Want to add 2fa [two-factor authorization], so the real owner can’t get in and you can do fast 2fa withdrawals? Click.”
“Do I have recourse against Microsoft? I am sure I am not the only one. Crypto users were targeted.”
A Reddit user says he lost 25,000 in crypto as a result of Microsoft’s data breach. | Source: screenshot
Microsoft initially downplayed Outlook hack
The victims are understandably outraged at having their crypto stolen and the violation of their privacy. But they’re even more incensed at Microsoft’s apparent cover-up of this screw-up and their lax reaction to the aftermath.
When TechCrunch reported on the Outlook data breach two weeks ago, Microsoft claimed it only affected “email metadata and customer information, such as subject lines and the names of other email addresses users communicated with.”
When confronted with evidence that email content was also compromised, Microsoft backpedaled and sent breach notification emails to victims admitting its screw-up.
Dutch engineer: Microsoft is trying to cover this up
Jevon Ritmeester says he’s planning to file a police report. Moreover, he plans to hold Microsoft accountable for the financial damage he suffered and the leak of sensitive personal information as a direct result of the tech giant’s alleged negligence.
“I feel Microsoft is trying to cover up and is not taking this seriously. I think Microsoft talks way too lightly about this leak. There are a lot of users who have suffered damage in one way or another as there is a lot of sensitive information in an inbox.”
As it is, Microsoft can afford to restore the financial damage to hacking victims, since it reported record third-quarter earnings.
THREAD: $MSFT Q3 EARNINGS
Revenue: $30.6 billion ⬆️ 14%
Operating income $10.3 billion ⬆️ 25%
Net Income: $8.8 billion ⬆️ 19%
EPS: $1.14 pic.twitter.com/Jr3c3vr63I— Microsoft (@Microsoft) April 24, 2019
[ad_2]
Source link