The encyclopedia · Software & IT · Technical decision · 2000
ILOVEYOU virus cost $10B - creator walked as Philippines had no hacking law
A simple VBScript email worm with 'ILOVEYOU' in the subject line infected 10% of all internet-connected computers in 2000. The creator walked free.
Onel de Guzman · 2000-05-04
What happened
On May 4, 2000, a computer worm spread across the world within hours. It arrived as an email with the subject line 'ILOVEYOU' and an attachment named 'LOVE-LETTER-FOR-YOU.TXT.vbs'. Windows' default setting to hide known file extensions made the .vbs file appear as a harmless text file. When opened, the worm overwrote media files, sent itself to every contact in the victim's address book, and stole dial-up internet passwords by downloading a trojan.
The worm spread so fast that it infected an estimated 10% of all internet-connected computers, forcing the Pentagon, CIA, British Parliament, and major corporations to shut down their email systems. The total damage was estimated at approximately $10 billion in cleanup costs, lost productivity, and system repairs. The worm's creator was a 22-year-old dropout named Onel de Guzman from the Philippines, who had designed it to steal dial-up passwords so he could access the internet for free.
When the Philippine authorities tracked de Guzman down, they discovered a problem: the country had no laws against computer hacking. All charges were dropped. The case prompted the Philippines to pass its first cybercrime law, and the ILOVEYOU worm became a landmark event in the history of computer security, demonstrating how a simple social engineering attack could bring down the world's largest institutions.
Why it happened
- Windows' default setting to hide known file extensions let the .vbs attachment appear as a harmless .txt file — millions of users clicked what looked like a love letter.
- The worm spread via email contact lists, so it appeared to come from a trusted source, making recipients far more likely to open it.
- The creator walked free because the Philippines had no computer crime laws — a legal gap that left the country unable to prosecute him.
- No antivirus signatures existed for the worm at the time of release, and the speed of the infection (hours) overwhelmed manual defenses.
The lesson
Social engineering defeats any technical defense. A fake love letter did more damage than any sophisticated exploit. Security is about people, not software.
Aftermath
The ILOVEYOU worm prompted the Philippines to pass its first cybercrime law. The case became a defining moment in computer security, establishing that the weakest link in any system is the human clicking the attachment. De Guzman was tracked down in 2019 working at a mobile phone repair stall in Manila, where he admitted creating the worm. The worm's rapid spread changed how organizations deployed email security, and the 'ILOVEYOU' subject line entered the lexicon as shorthand for the cost of social engineering.
Sources
spotted an error? The club wants to know.
More like this
NextTech, 'Vietnam's Alibaba', founder arrested for crypto fraud, token lost 99%
eFishery was Indonesia's first unicorn — $600 million of its revenue was fake
Leflair raised $12M, burned through it, and owed $2M to 500 suppliers when it shut down
Somewhere, someone solved the problem this company failed at. 2nd Opinion →

Comments · 0
Sign in to join the comments.