The email login details of thousands of Hotmail users have been compromised after the password information for more than 10,000 accounts appeared online.
According to the website Neowin.net, an anonymous user posted details of the accounts to Pastebin.com, an online forum used by developers to share snippets of programming code. The list has since been removed from the site, but included the login details used by around 10,000 Microsoft Hotmail, Windows Live and MSN account holders.
Neowin said the details appeared legitimate, and that most of the accounts exposed by the leak belonged to European web users, and listed accounts starting with A and B, suggesting there may be additional lists.
The source of the leak remains unclear, but it seems likely that the details were collected as the result of "phishing" scams, which use fake websites to trick people in to revealing personal details, such as account login information, believing they are on a legitimate site.
Microsoft said that it had been made aware of the problem.
"We're actively investigating the situation and will take appropriate steps as rapidly as possible," said Microsoft in a statement. "Microsoft is committed to protecting the privacy of our customers, and believe they deserve to have their personal data used only in ways they have agreed to, and in ways that provide value to them."
Users of Hotmail, Windows Live and MSN email accounts are advised to change their passwords and security questions immediately, in order to block unauthorised access to accounts. There are fears that hackers or cybercriminals could use these email accounts to gain access to sensitive or personal information, or to log on to online bank accounts and shopping websites to make fraudulent transactions.
"It's unclear at this stage whether the cause of the leak is phishing attacks or some kind of attack on Microsoft's servers," said Carole Theriault, a senior security consultant with Sophos. "These things do happen, and people shouldn't panic, but we recommend taking some practical steps. If their email address ends with @hotmail.com or @hotmail.co.uk, @msn.com or @msn.co.uk, or @live.com or @live.co.uk, they should change their account password and security question."
Hotmail is the largest web-based email service in the world, with an estimated 500 million users. The password leak comes at a difficult time for Microsoft. October sees the launch of Windows 6.5, it's new mobile phone operating system, as well as Windows 7, its new computer operating system which replaces Windows Vista.
Lukas Oberhuber, chief technical officer at Forward Internet Group, said the leak looked like the result of a phishing attack. "Those sorts of attacks are almost impossible to defend against," he said. "They are becoming increasingly sophisticated.
"One clue that your account may have been compromised would be if you suddenly got lots of emails saying that you'd requested account passwords to be reset.
"Hotmail is not the first web email service to be hacked in this manner, and it won't be the last."
--The Daily Telegraph