Warning about disclosure of access data and data leakage to an external mail provider Warning about disclosure of access data and data leakage to an external mail provider

The new Outlook app share passes on passwords and sends secret e-mail data with Microsoft.

The new Outlook, currently available as an update for Windows 11, does  a few things different than the old one: Those who try it share sensitive login data and mails with the Microsoft cloud. Data protection officers are worried about the recent developments. Ulrich Kelber, federal officer for privacy protection and freedom of information (BfDI), consider the news about the assumed data collection by Microsoft to be alarming. The BfDI has asked the Irish privacy protection officer, who is responsible for Microsoft in the EU for a report.

We encourage all Outlook users to read this article by Heise. While external mail providers have long been advertising to include mails from other mail accounts, in exchange for login data, there has been a recent increase in mail providers that cause login data and mails to be sent and saved by these providers. As the mail clients are programs which are installed on your own computer or mobile device, such leakage is usually less obvious. Therefore, we would like to take the opportunity to warn against use of such programs and services. Their use is not in line with the HRZ-user guidelines (cfl. § 3 Abs. 2 Ziffer 5). Up to date (december 2023) we know the following mail client applications to show this kind of behaviour:

• Outlook-App for Android and iOS,
• "New Outlook for Windows" (included in version 23H2 for Windows 11),
• Windows Mail (predecessor of the "New Outlooks")
• Outlook for macOS (when using IMAP with CloudSync),
• Edison Mail,
• Newton,
• BlueMail (under certain conditions on mobile devices),
• Spark and
• Xiaomi Mail.