Melissa 1999: The Word Macro Virus That Clogged the World's Inboxes
On 26 March 1999 a Word document emailed itself to 50 contacts at a time and overloaded mail servers. See how Melissa spread and how its author was caught fast.
On Friday 26 March 1999, people at offices around the world opened their email and found a message from a colleague that said it contained a document they had asked for. The attachment was a Microsoft Word file. Opening it started a chain reaction that, within hours, overloaded the mail servers of major companies. The Melissa virus became one of the first email-borne threats to reach the mainstream news.
Where it came from
Melissa was first posted to an adult-themed Usenet newsgroup, in a document that claimed to contain passwords for pay-to-view websites. This lure was effective on curious readers. Once the document was opened, the virus ran, because it was written as a macro, a small program embedded in a Word file.
Macros were designed to automate tasks, and Word could run them when a document was opened. That meant a document could carry code, which most people did not realise at the time. Macro viruses had already existed, but until Melissa they had mostly spread slowly, through shared disks.
How it worked
When an infected document was opened on a computer that had Microsoft Outlook installed, the macro did several things.
- It sent a copy of the infected document to the first 50 addresses in the user's Outlook address book.
- The email carried a subject line that included the sender's name, so it looked personal, with a message saying that the attachment was a document the recipient had asked for.
- It infected the template that Word used for new documents, so that documents created later would be infected too.
The effect was exponential. Each infected machine sent 50 messages. If even a few recipients opened the attachment, the number of messages doubled again and again. Because the mail looked like it came from someone the recipient knew, many people did open it.
The result
Mail servers at many large organisations were swamped by the volume of messages. Some companies, reportedly including large technology firms, shut down their email gateways to stop the spread. The damage was mostly disruption rather than destruction. The virus did not erase files in a systematic way. But the work lost to unavailable email was real, and US officials later put the cost at tens of millions of dollars.
The Computer Emergency Response Team at Carnegie Mellon University, created after the Morris worm, issued advisories and coordinated the response. Antivirus vendors released updates within hours.
How the author was caught
Within days, investigators identified David L. Smith, a 30-year-old programmer from New Jersey. The key clue came from the infected documents themselves. Word at the time embedded a unique identifier in the files it created, and an analyst helped link the earliest copy to a particular computer and an account used to post it. Combined with logs from the internet provider, this led the FBI to Smith, who was arrested on 1 April 1999.
Smith later said he named the virus after a dancer he had met in Florida. He pleaded guilty, cooperated with investigators in other cases, and in 2002 was sentenced to 20 months in federal prison and fined. Prosecutors had said the damage exceeded 80 million dollars, a figure that reflects their assessment and that other observers treated with caution.
The speed of the investigation was itself notable. Earlier malware authors had often stayed anonymous for years, if they were ever identified. Melissa showed that digital traces such as document metadata, server logs and account records could lead to an arrest in a matter of days. It was a warning to would-be virus writers that sending code across the internet does not make you invisible, and it helped establish cooperation between investigators, internet providers and security researchers as a normal part of handling cybercrime.
Why Melissa mattered
Melissa marked a change in the nature of malware. Earlier viruses spread at the speed of physical disks. Melissa spread at the speed of email, reaching a global audience in hours. It also introduced a pattern that would be reused by many later worms: using the victim's own address book to deliver the attack, so that each message appears to come from a trusted source.
It helped push software makers to reconsider macro security. Later versions of Microsoft Office disabled macros by default or warned users before running them, a change that has been tightened further over the years because malicious macros have remained a favourite tool of criminals.
The lesson for site owners today
Nothing in Melissa depended on technical brilliance. It relied on a message that looked trustworthy and a document that could run code. The same combination drives most phishing and malware campaigns today, and it often targets small businesses, which receive invoices, enquiries and documents from strangers all day.
- Treat unexpected attachments with suspicion, even from known senders.
- Check with the sender through another channel if anything looks odd.
- Keep macros disabled unless you really need them.
- Use a mail system that scans attachments and filters spam.
Authentication records for your domain also help. SPF, DKIM and DMARC make it harder for criminals to send messages that appear to come from your own address.
Practical how-to guides are collected in the knowledgebase.
Protecting your business mail
Our business email hosting is set up with your own domain, and the guide to SPF, DKIM and DMARC in our knowledgebase shows how to configure it. The security page covers more of the basics.
