Office 365 email hacked

[supportman]

I've had a few users report their Office 365 accounts being hacked recently, generally when they used the same password on other services (I suspect the Edmodo hack has something to do with this).

 

I've got them to change their password and removed the spam emails. Microsoft has puts a temporary block on their accounts.

 

Does anyone have any information on how long this block lasts or how to unblock them? Normally its been students in the past and we have just waited, but recently a few teachers have experienced it and of course they would like to know when their email will start working again!

Edited November 5, 2018 by supportman

[Michael]

You need to navigate to the Exchange Admin Center > Protection > Quarantine and unblock accounts.

 

Wait 10-15 mins and users can then send e-mail externally again.

[abaxter2]

In my setup this has changed to the: "Security and Compliance Center" > expand Threat Management > > Review and then choose Restricted Users. More info here: https://docs.microsoft.com/en-us/office365/securitycompliance/removing-a-user-domain-or-ip-address-from-a-block-list-after-sending-spam-email

[supportman]

Great! thats what I was missing... Strange there is nothing on the front portal page about this, I had 9 accounts disabled and its simple to unblock from the compliance center when you know where it is!

 

EDIT: found this article burried on google about the procedure

 

https://docs.microsoft.com/en-gb/Office365/SecurityCompliance/removing-a-user-domain-or-ip-address-from-a-block-list-after-sending-spam-email

[supportman]

So on speaking to most of our students it seems that all of them either signed up on Edmodo or 000webhosts websites, both of which have been compromised in recent years as confirmed on https://haveibeenpwned.com

[BKGarry]

just out of interest, was this an email asking for bitcoin because they had been on "interesting" websites, or was it the one that sent out a lot of emails to the entire of the address book and other addresses in the recently used etc with a Dropbox image for an invoice?

[supportman]

It was general spam emails of all kinds, mostly over 200 sent in a single night from their accounts. Some were viruses and others with adult themes.

 

Microsoft quickly restricts the accounts, but its still annoying.

 

EDIT: Another one I have seen is the accounts being sent their password in plain text and a bitcoin reward asked for. The credentials clearly come from one of the website hacks mentioned earlier and people have generally changed their passwords since then, but its still quite unnerving for the users to see their passwords posted like that.

Edited November 6, 2018 by supportman

[E_G_R2]

Had a few of them recently (Bitcoin's)

 

Also had the 200+ spam one. What was interesting was that the day before the spamming there were two emails sent with a heading 'message from 'school name here'.