Melissa virus cost $80M - hit a million email accounts, creator went to prison

On March 26, 1999, David L. Smith posted an infected Word document to the alt.sex Usenet group. The document, named 'list.doc', contained a macro virus that, when opened in Microsoft Word, used the victim's Outlook address book to email copies of itself to the first 50 entries. The email appeared to come from a known contact with the subject line 'Important Message From' followed by the sender's name — a social engineering trick that made recipients trust the attachment.

Within days, Melissa had infected hundreds of thousands of computers and disrupted about one million email accounts. Corporate email servers were overwhelmed by the volume of virus-generated messages. The FBI estimated cleanup and repair costs at $80 million. The virus exploited Word's macro scripting and Outlook's address book access, demonstrating how much damage a simple script could do when it turned trusted contacts into vectors.

Smith was caught when investigators traced the virus through metadata embedded in the original Word document, including the author's name and computer ID. He pleaded guilty in December 1999 and was sentenced to 20 months in federal prison, a $5,000 fine, and 100 hours of community service. The Melissa case was the first major prosecution under computer crime laws and established that spreading a virus was a federal crime with real consequences.