17

I am having serious trouble with my previous university email account (Office365), provided by the university where I finished my master’s studies last year (I am currently pursuing a PhD at another university in a different country). The account is still active but I am no longer using it to send any email, although I have been receiving messages for alumni.

A few days ago, for a reason I still do not understand, a blank Teams meeting invitation was sent FROM my account to multiple professors and faculty members. The account seems to be hacked. I noticed it today when I received a notification saying that one of the recipients “rejected” the invitation. I am very confused and embarrassed.

I successfully cancelled the Teams meeting (which was automatically added to my calendar), but then, I logged out of that account (just to check my other account), and now I can no longer log into it again.

I am going to contact the university for technical support, but here is my question: Should I send an apology email to the recipients of the invitation? I want to apologize, but it’s been more than half a year since I graduated, and I no longer get in touch with any of them. And more than half of them are the ones with whom I interacted only once during my studies (e.g. to ask for an internship opportunity), and they probably do not even remember/recognize me. Also, except for the one who rejected the invitation, none has reacted to it in any way, so I am assuming that they haven’t yet seen the invitation or simply ignored it, noticing that it was mistakenly sent.

Would it be appropriate for me to send them an apology email? Or would that just end up bothering them, given that they are all busy and keep receiving numerous emails every day?

Any advice or suggestions are highly appreciated.

4
  • 12
    It's more likely that someone is simply spoofing your mail address. Anyone can do this if they know that that address is, they do not have to have access to your account (as the word "hacked" implies). This happens all the time, e.g. if your address is in someone else's contact list that has been leaked. It's weird that someone would send out invitations though, usually it's BUY BITCOIN TODAY or something like that. You should change your password but I can guarantee that tech support will just tell you to forget about the incidence. An apology mail seems excessive, people will understand. – Peter Jan 18 at 21:11
  • 7
    I agree with @Peter, and definitely do not send an email to everyone. I'm a post grauduate student and get emails like this which appear to be from my supervisor or other prominent users (i.e. who have their email address public). I ignore them as I'm well aware they're spoofed, it's quite annoying to get a deluge of "apology", followed by "this is a spoof" followed by "please don't CC all"... There's a famous microsoft incident you might want to research... – David Waterworth Jan 19 at 3:11
  • 3
    It's too late now, but you can enter a message when you send a cancellation so you could have sent the apology as part of the cancellation. – Rup Jan 19 at 10:13
  • 1
    "now I can no longer log into it again" may mean that either an attacker managed to complete the take-over just then (and changed the password), or that tech support or whoever is in charge already noticed the abuse and disabled the account – Hagen von Eitzen Jan 20 at 7:07
44

Contact tech support and let them know what happened. They can probably clean it up appropriately. The apology message might be better if it comes from them. In any case, ask them for advice.

Perhaps you need to pay more attention to passwords and watch out for phishing attacks.

1
  • 25
    Given the evidence in the question, the conclusion that the account was "hacked" may be a bit premature. In any case contacting IT is the right thing to do first. – Louic Jan 18 at 11:21
7

The first step is to reset your password, not just on this account, but everywhere that you use the same password or have easy to guess passwords. Then contact your IT support for advice. They will handle the communication to your alumni. To avoid this, or something worse happening again I would recommend using a password management application, these do more than just store your passwords, they can also randomly generate complex passwords that you will never need to remember. Activate multi-factor authentication on every account that allows it. Search the Microsoft website on how to recover a hacked or compromised Microsoft account.

4

If you still have the list of recipients of those team invitations, consider sending a message to them immediately to warn them. Viewing or accepting such invitations could run the risk of getting a virus or revealing personal data on a phishing website. This is the case when every minute counts, since a warning is only good if the recipient sees it before opening the spam message.

Apology is generally a good idea, but in this case you actually shouldn't sound too apologetic. You don't want to sound guilty and make people assume this incident is your fault, when in fact it may be someone else's.

And make sure to resolve this quickly: either reset the password on the account if you still need it, or contact the IT and ask them to disable it. An apology for the spam message followed by more spam doesn't look good.

3

Would it be appropriate for me to send them an apology email?

The problem is that somebody else sent a useless automated message. If you send another automated message, this will not help the situation. So no.

3
  • 8
    I don't think "automated" means what you think it means – Asteroids With Wings Jan 19 at 19:00
  • 2
    Were you perhaps going for "unsolicited" instead of "automated"? – Davy M Jan 20 at 21:33
  • @DavyM No. ...... – Anonymous Physicist Jan 20 at 21:47
3

Ditto on using a password manager. Dashlane is a free one that gets decent reviews - get the browser add-in(s) and the phone app and you'll have access to your passwords from all of your devices. Another thing I would do is check all of your email accounts on https://haveibeenpwned.com/ to see if they've ever been involved in a large data breach. I would recommend signing up for alerts from that site as well.

Remember - don't reuse account passwords. You can lose access to multiple accounts that way like dominos.

2

Sending an apology for compromised-account spam would likely only make things worse, especially since your university's email admins may have been able to delete some of the messages before the recipients even saw them.

If you cannot log back into the account, it's possible that IT saw suspicious activity and froze it, but it's also possible that someone maliciously changed the password.

Aside from immediately contacting your IT department for help and following their advice, you should change your password, change your password on any site where you use the same password, and thoroughly check the settings on your account for any unauthorized changes, such as an auto-reply message, email signature, or forwarding address with unfamiliar contents.

Not the answer you're looking for? Browse other questions tagged or ask your own question.