Hotmail password breach blamed on phishing attack

Microsoft has confirmed that the publication of thousands of Hotmail passwords was the result of a phishing attack against users of the popular email service.

Precise details of the strike, which was first uncovered on Monday, remain unclear. But in a statement, the American software company said that the culprit had not breached its security, and had instead fooled Hotmail users into handing over their details.

"Over the weekend, Microsoft learned that several thousand Windows Live Hotmail customers' credentials were exposed on a third-party site due to a likely phishing scheme," it said.

"Upon learning of the issue, we immediately requested that the credentials be removed and launched an investigation to determine the impact to customers. As part of that investigation, we determined that this was not a breach of internal Microsoft data and initiated our standard process of working to help customers regain control of their accounts."

Phishing attacks are common online, and usually begin with the arrival of a legitimate-looking email containing a link to a realistic-looking website - often a bank or email provider. Users who click onto the fake website are then encouraged to log in - unwittingly handing their details over to the perpetrator in the process.

However, the full extent of the Hotmail attack is not yet fully understood.

Initial reports from the NeoWin website, which broke the story, suggested that 10,000 accounts had been compromised. But it appears that more account details are also online. The Guardian has seen a series of several hundred passwords posted online, while NeoWin is now claiming the existence of another file containing 20,000 passwords.

This confirms experts' suspicions that the initial 10,000 accounts posted online were just a portion of a larger breach, since that anonymously-produced list only included Hotmail accounts beginning with the letters A and B.

If the criminal behind the theft had also stolen details from usernames from the rest of the alphabet, it could potentially affect hundreds of thousands of people worldwide.

Security experts have urged Hotmail users to change their passwords immediately - as well as any other websites where they use the same login details. Microsoft, meanwhile, said it was shutting down access to the affected accounts temporarily as a way of protecting those users who had been tricked.

The stolen account details appeared on a website, Pastebin.com, which is normally used by programmers to share pieces of computer code with each other.

Paul Dixon, the British software developer who runs Pastebin, told the Guardian that he had already taken measures to block the information.

"There are filters in place to spot abusive posts," he said. "I've enhanced the filters to ensure the list which is doing the rounds cannot be reposted."

Dixon added that he would "assist any law enforcement agencies which want to try and find the miscreants".