Microsoft Ordered to Restore Hacked Hotmail Account and Pay Damages After Hackers Demand Cryptocurrency

• How Did the Hotmail Hack Unfold?
• Why Did the Court Rule Against Microsoft?
• What Were the Legal Consequences?
• How Did Microsoft Respond?
• What Does This Mean for Cybersecurity?
• FAQs

In a landmark ruling, a Brazilian court has ordered Microsoft to restore a hacked Hotmail account and compensate the victim after cybercriminals demanded cryptocurrency to return access. The case highlights growing concerns about digital security and corporate accountability in the face of escalating cyber threats.

How Did the Hotmail Hack Unfold?

The victim, a Brazilian woman from Goiânia, had used her Hotmail account for years as her primary email for social media, banking, and other critical services. On April 16, 2025, she began receiving suspicious verification codes from platforms like Uber, Airbnb, Instagram, LinkedIn, and Facebook. Soon after, she lost access to her Instagram account—all linked to her Hotmail. Hackers then made fraudulent purchases in her name on Amazon and Casas Bahia, with deliveries scheduled to Ceilândia and Goiânia.

Why Did the Court Rule Against Microsoft?

The victim accused Microsoft of failing to protect her account, leading to severe psychological distress due to extortion attempts. Hackers demanded cryptocurrency in exchange for restoring her email access and threatened to leak intimate photos. Despite Microsoft’s defense—claiming the account was still active and blaming the victim for not using security features—the judge ruled in her favor. The court emphasized that cyber risks are inherent to tech companies, referencing a similar precedent involving Brazilian crypto brokers.

What Were the Legal Consequences?

Microsoft was given 20 days to restore the Hotmail account or face daily fines of up to R$200 (capped at R$6,000). The company was also ordered to pay R$3,000 in moral damages. While the ruling is subject to appeal, Microsoft won’t cover legal fees. The decision underscores a shift toward holding tech giants accountable for security lapses.

How Did Microsoft Respond?

Microsoft argued the civil court lacked jurisdiction and dismissed the victim’s evidence as "fragile," stating she failed to use recovery tools. However, the judge rejected these claims, noting that users shouldn’t bear the brunt of systemic security failures.

What Does This Mean for Cybersecurity?

This case mirrors global trends where courts increasingly side with consumers against corporations. With crypto-related cybercrimes rising, experts urge platforms to bolster defenses. As one analyst quipped, "If your security relies on users remembering 2FA codes, you’re already losing."

FAQs

What happened in the Microsoft Hotmail case?

A Brazilian woman sued Microsoft after hackers took over her Hotmail account, demanded cryptocurrency, and made fraudulent purchases. The court ordered Microsoft to restore her account and pay damages.

Why was Microsoft held responsible?

The judge ruled that cyber risks are part of Microsoft’s operational burden, and the company failed to provide adequate account protection.

What penalties did Microsoft face?

Microsoft must restore the account within 20 days or pay fines up to R$6,000, plus R$3,000 in moral damages.