TRUE CRIME ATLAS
← Back to all cases

ILOVEYOU Virus

New releasePublished May 23, 2026Updated May 23, 2026
DisputedVisual case overview

One attachment · global disruption · a legal gap exposed

The love letter that rewrote cybercrime

A disguised email attachment used Outlook address books to spread worldwide within hours, exposing both the power of social engineering and a gap in Philippine cybercrime law.

Read the full case overview

ILOVEYOU was a mass-mailing VBScript worm that began spreading on May 4, 2000 through Microsoft Outlook with the subject "ILOVEYOU" and the attachment "LOVE-LETTER-FOR-YOU.TXT.vbs." It copied itself through address books, overwrote files, and attempted to steal internet-access credentials, causing worldwide disruption across governments, businesses, and personal computers. Philippine investigators centered public suspicion on Onel de Guzman and associates, but the case exposed a legal gap that prevented a straightforward criminal adjudication at the time; it later became a landmark in the history of social engineering, malware response, and cybercrime law reform.

Follow the full timelineCompare theories
Screenshot of the ILOVEYOU email message

The lure

A familiar subject line hid executable code

The scale

The case in four numbers

1
email attachment
used as the primary social-engineering lure
1
day to global crisis
after the May 4 outbreak began
3
attribution theories
mapped in the investigation record
3
people named in the early probe
before attribution centered on one

A fast-moving outbreak

The code spread faster than the law could respond

Within hours, Outlook automation amplified a disguised attachment worldwide. Investigators moved quickly, but the applicable Philippine law did not.

See all 3 mapped locations →
  1. 01

    May 4, 2000

    ILOVEYOU begins global spread via Outlook email

    The VBScript worm spreads worldwide through Microsoft Outlook using the subject "ILOVEYOU" and the attachment "LOVE-LETTER-FOR-YOU.TXT.vbs," quickly disrupting governments, companies, and home users.

  2. 02

    May 4, 2000

    Early technical alerts and analysis posted

    Security mailing lists publish dissection of the email’s subject, body text, and dangerous attachment behavior, warning Outlook users not to open it.

  3. 03

    May 5, 2000

    Philippine NBI targets local programmers

    Investigators identify Onel de Guzman and Reonel Ramones as targets of a criminal probe connected to the ILOVEYOU worm.

  4. 04

    May 1, 2000

    Onel de Guzman emerges as the central public suspect

    Reporting and investigative focus increasingly center on former AMA Computer College student Onel de Guzman as the suspected author or originator of the worm.

  5. 05

    May 1, 2000

    Philippine legal gap limits immediate prosecution

    Investigators and prosecutors confront the absence of a clear Philippine cybercrime statute directly covering the conduct exposed by the ILOVEYOU outbreak.

  6. 06

    Jun 1, 2000

    Electronic commerce reform follows the outbreak

    The case becomes part of the pressure for new Philippine legal frameworks addressing electronic transactions and cyber-enabled misconduct.

Why it worked

Trust, automation, and attribution

1
Strongly supported

The subject line and disguised attachment made social engineering central to the worm's success.

2
Strongly supported

Outlook address-book automation is what turned ILOVEYOU from a malicious attachment into a global outbreak within hours.

3
Strongly supported

Philippine investigators and later reporting consistently centered public suspicion on Onel de Guzman.

4
Strongly supported

A lack of clearly applicable computer-crime law in the Philippines prevented a clean criminal adjudication of the case at the time of the outbreak.

Onel de Guzman in a May 2000 press photo
2000
outbreak year

Public attribution without a clean adjudication

Investigators and later reporting centered on Onel de Guzman, but suspicion, authorship, motive, and legal responsibility remain distinct questions.

Compare the attribution theories →

Where certainty changes

Not every event carries the same weight

Open each layer to see what the archive treats as core, contested, or unresolved.

01EstablishedThe outbreak mechanics are well documented
The disguised VBScript attachment, Outlook address-book propagation, file damage, and credential behavior explain the outbreak's speed and reach.
02AttributionOnel de Guzman remains the central public suspect
The investigation, thesis connection, and later reporting support an Onel-centered account, but no completed criminal trial tested the full authorship case.
03Open questionHow much responsibility belonged to one author?
The early probe involved several people, while the surviving public narrative increasingly concentrated on one name.

Go deeper

Choose your path through the case

This overview is the map. The case tabs hold the underlying events, people, media, locations, and source material.

7 events 3 people 3 theories 3 locations 4 images Case documents