The Melissa Virus: What a 1999 Email Outbreak Still Teaches Businesses

Hackers & Hooks | Season 1, Episode 8

On Friday, March 26, 1999, a Word document started landing in inboxes around the world. It came from someone the recipient knew. The subject line began “Important Message From” followed by that person’s name, and the note inside said, “Here is the document you requested … don’t show anyone else ;-)”. By the following Monday, it had reached more than 100,000 computers at more than 300 organizations.

That was the Melissa virus. On this episode of Hackers & Hooks, Nick Gipson and co-host Isaac Reed break down how a self-described prank became a turning point for email security, and why the trick at its heart still shows up in small business investigations today.

A “Prank” That Overloaded the World’s Inboxes

Melissa was written by David L. Smith and was reportedly named after an exotic dancer in Florida. Smith used a hijacked AOL account to post an infected Word file to alt.sex, a public Usenet discussion group, with the promise that it held free passwords to dozens of paid adult websites. Curiosity did the rest.

When someone opened that document in Microsoft Word, hidden code took control of Microsoft Outlook and mailed the same file to the first 50 people in that person’s address book. Each recipient saw a message from a friend or coworker, and anyone who opened the file sent it on to 50 more of their own contacts. The numbers grew fast.

“If your coworker emailed you, you would actually open it… Ease of access became a security risk, as it does with everything.”

Isaac Reed, Hackers & Hooks

Melissa did not delete files or demand a ransom. The damage came from sheer volume. According to the FBI, email servers at more than 300 corporations and government agencies were overloaded, some were shut down entirely (Microsoft’s among them), and about one million email accounts were disrupted. The FBI estimated $80 million in cleanup and repair costs.

There was a quieter risk, too. Because Melissa mailed out whatever infected document it had attached itself to, the U.S. Government Accountability Office warned that under some circumstances it could send confidential files to outsiders without the user knowing. Smith was arrested within a week, pleaded guilty, and in 2002 was sentenced to 20 months in federal prison.

When the Feature Becomes the Bug

Melissa did not break into anything. It used a normal part of Microsoft Office called a macro, a small built-in program that automates routine work such as filling in a form letter. Businesses relied on macros then and still do today, so they could not simply be switched off for everyone. Melissa used that legitimate feature exactly as designed, just for the wrong purpose.

“The feature has become the bug in this scenario.”

Nick Gipson, Hackers & Hooks

Word could warn users before running a macro, and Melissa even tried to lower those security settings once it was running. But a warning only helps when people stop and read it. Nick pointed out that complacency is the weak spot: when the same pop-up appears every time someone opens a document, people learn to click through it without thinking.

The pattern did not end in 1999. The ILOVEYOU virus followed in May 2000 with a similar playbook, and attackers have kept finding ways to misuse ordinary Office features. In 2017, for example, Microsoft disabled a data-sharing feature called Dynamic Data Exchange in Word after criminals abused it. In 2022, Microsoft announced it would block macros by default in Office files downloaded from the internet. Even so, Nick noted that he still sees the old trick in his investigations: a small business, such as a law firm, receives an “invoice” spreadsheet that carries malicious code.

For a business, the impact goes beyond one infected computer. A single opened file can tie up email for everyone, send internal documents to clients and partners, and leave the company explaining to customers why their inbox is full of messages from its address. That means downtime, possible data exposure, and reputational harm.

Lessons for Small Businesses

• Verify unexpected attachments, even from people you know. Melissa spread because it came from trusted contacts. If a file arrives that you were not expecting, confirm with the sender by phone or a fresh message before opening it.
• Keep macros off for anyone who does not need them. Ask your IT team or MSP to confirm that Office blocks macros in files from the internet and that only approved macros run for the staff who use them.
• Make warnings mean something. If people see the same prompt every day, they stop reading it. Short, regular training helps. During the Melissa outbreak, the GAO found that organizations that had trained and warned their employees fared much better than those that had not.
• Watch for unusual behavior, not just bad files. Melissa’s damage came from one computer suddenly emailing dozens of people. Monitoring for odd activity, such as a mailbox sending far more than normal, gives you a chance to act before a problem reaches your clients.
• Know who you will call on a bad day. Decide in advance who can isolate a computer or pause email, who contacts your IT provider, and how you will tell customers if something goes out that should not have.

How Gipson Cyber Helps

The lesson from Melissa is that attackers rarely need to break anything. They use the tools your team already relies on every day, which is why it helps to have people watching for activity that does not look right.

Gipson Cyber’s Business SOCaaS is a managed SOC for small business: 24×7 monitoring with real human responders. It is technology-agnostic, so it works with the tools you already have, and it is built to work alongside your existing IT team or MSP rather than replace them. If something does get through, our Business DFIR team helps you contain it, understand what happened, and get clear reporting on what to do next.

No service can promise that a malicious file will never reach your inbox. What we can do is help reduce the risk and make sure you are not facing it alone. If you think you have been hacked right now, go to 800cyber.com.