“You should be careful when receiving any e-mails from any misleading domain name, any e-mail that requests personal information or payment, or any unsolicited request from an untrusted source.” Microsoft told users that it didn’t know what data was viewed by the hackers or why, but cautioned that users might as a result see more phishing or spam emails as a result. Once identified, those credentials were disabled. The hackers got into the system by compromising a customer support agent’s credentials, according to the letter. The breach occurred between January 1 and March 28, Microsoft’s letter to users said. Microsoft is still recommending that affected users change their passwords regardless.

According to an email Microsoft has sent out to affected users (the reader who tipped us off got his late Friday evening), malicious hackers were potentially able to access an affected user’s e-mail address, folder names, the subject lines of e-mails, and the names of other e-mail addresses the user communicates with - “but not the content of any e-mails or attachments,” nor - it seems - login credentials like passwords.