I have watched emails get deleted and rearranged for over 18 months. Australian Financial Complaints Authority ruled in favour of the Insurer who refused my Cyber Event claim on the basis I did not submit sufficient evidence to support my claim of unauthorised access . I argue that there are many platforms accessed including Microsoft
The information below become available quite late – can anyone make sense of the data below and perhaps offer a theory on how mail was selectively deleted. Prior to February 2020 my UK based Support person advised the deletions were always recorded on my devices and on my IP addresses.
Once he left I lost track of deletion events.
In July 2020 I witnessed folders of emails reshuffle contents and repopulate without me touching anything.
I have one device that was taken off line mid 2020. It contains emails that are different from those that are online. There are emails missing from suppliers for 8 months on the offline device. Email headers are also out of sync with the time stamp on the email in the browser window.
In 2019 and 2020 when I signed into the browser using portal.office.com on a PC it would have a different set of folders to that shown when I clicked on the Microsoft Exchange app on my MacBook Pro. I would frequently experience numerous disconnections issues on my MacBook Pro – autodiscover windows would appear several times a day.
I would ask IT support people why the above was happening and I could never get an adequate response.
Tenancy commenced 10/8/2018
Aust IT Company 1 – August to October 2018
Aust IT Company 2 – September 2018 to November 2019
UK based Support – 2012 to February 2020
Aust IT Company 1 migrated mail from Google to Microsoft in August 2018 . They set up my Tenancy and they claim they took out a Microsoft Office 365 account in August 2018 with 15 subscriptions. They made a mess of the migration. My emails ballooned out of control and I moved to IT Company 2.
IT Company 2 took over the subscription in October 2018. They took out a new subscription in February 2019 as I needed more features. I paid them my last subscription in late 2019.
UK based Support managed the Microsoft Account from September 2018 to February 2020.
In late September 2020 a Microsoft Support person in the USA advised a number of Exchange Online subscriptions and Microsoft 365 subscriptions were purchased from wholesaler Synnex between August and October 2018. Three subscriptions were active and paid for until 23/8/20. I did not pay anyone for those three subscriptions and no one is claiming responsibility for keeping the subscriptions going.
Synnex has advised the only consultant at the time who purchased licenses for my domain was the Aus IT Company 1. Company 1 deny all knowledge of the below subscriptions other than Microsoft Office 365 x 15 subscriptions.
In December 2020 Microsoft advised they no longer have a record of the subscriptions made between August 2018 and February 2019. The evidence has been wiped – not good
In September 2020 a Microsoft Support person in the USA gave me the following information via chat. He also gave me the subscription GUID for each. He said he should not give me the information but he "felt sorry for me"
Exchange Online (Plan 2)
23/8/2018
23/8/2019
23/8/2020
1
Exchange Online (Plan 2) x1
23/8/2018
23/8/2019
23/8/2020
1N/A deleted
Exchange Online (Plan 1)
15/8/2018
15/8/2019
15/8/2020
1N/A Deleted
Microsoft 365 Business Standard
18/10/2018
18/10/2019
18/10/2020
1N/A Deleted
Exchange Online (Plan 1)
13/8/2018
13/8/2019
13/8/2019
5 N/A deleted
Exchange Online (Plan1)
10/8/2018
10/8/2019
10/8/2020
10N/A deleted
A section of my MX records are missing from securitytrails.com between 13/8/2018 and 5/9/2020. This record went missing in about September 2020. The MX records for mydomain.com show the following
mail server
*****-com.mail.protection.outlook.com Microsoft Corporation 2020-10-05 (2 months ago) 2020-12-30 (today) 2 months
Google LLC 2020-06-23 (6 months ago) 2020-09-05 (3 months ago) 2 months
Google LLC 2017-05-26 (3 years ago) 2018-08-13 (2 years ago) 1 year
The MX records for mydomain.com.au is showing
‐ ‐ 2020-03-30 (9 months ago) 2020-12-30 (today) 9 months
GoDaddy.com, LLC 2018-02-23 (2 years ago) 2020-03-30 (9 months ago) 2 years
mydomain.com was at fasthosts in the UK and it claims MX records were added 13/8/2018
mydomain.co.uk was also at fasthosts in the UK and it claims MX records were added 18/2/2019
Go Daddy held the mydomain.com.au and the blog was hosted at Go Daddy too. Someone set up an email account at godaddy using mydomain.com. That email address was receiving mail and could be accessed via cpanel.
I am aware that data is deleted by Microsoft 30 days from the day a subscription ends. So theoretically you could move from a Microsoft Account (A) to an Exchange Account (B) and then back to a Microsoft Account (A) and effectively remove any trace of say Yammer log files that were associated with a user when Microsoft Account A existed. Would that explain the large number of Microsoft Exchange Subscriptions?
And would numerous subscriptions allow for selective removal of mail over time (say 2 years) ?
