Life: Someone attempted to access my Spam Microsoft Hotmail Account

Fortunately, the account they attempted to hack is an account that I use for all non-personal uses. I don't know if anyone has ever successfully hacked my email to my knowledge, but it is likely there may have been a person that I am unaware of. I have changed my passwords multiple times when Microsoft messages that there seems to be suspicious activity.

Changed Password

Today I got that message about two hours ago. I completely forgot my password so I reset the password. It then sends a code to the Authenticator app but I have never set up this account to my Authenticator app so I cannot receive the code. I send it to a backup email. Change password. Signed in, wants to verify with Authenticator app. Changed it back to email. Which then had me change my password again. (All passwords can be repeated so I have to come up with a new password that I am likely to forget again since I rarely use this account except to get verification emails). Finally able to access email and added to my Authenticator.

Suspicious Activity

Quickly went to the account access history and I see a whole list of different countries for the last 3 weeks. The first few activity were 3-8 days apart (Russia, US, and Canada). Then it suddenly bursts into multiple attempts within the last 6 hours which appears to be about 5 attempts per hour. Each time from a different country. 

Why did it take 4 hours for the suspicious activity to be triggered? From activity history after Russia, US, and Canada, there were China, Morocco, India, Mexico, Egypt, Peru, Indonesia, Brazil, Azerbaijan, Vietnam, Iran, Albania, Cambodia, and Spain. All that within 6 hours. It seems it should have triggered after the first hour. Who can possibly travel that quickly or change that many VPNs or that many cloud services in such a short period time with no past history of doing so?

Summary

Looks like someone attempted to hack my email. I changed the password. I find it suspicious why it took so long for the Suspicious activity to be triggered. Fortunately, no harm appears to have been done. History says no successful logins. Even if successful, account isn't used for anything but still sucks to have to remember yet another password.