TRUE CRIME ATLAS
← Back to all cases

ILOVEYOU Virus

New releasePublished May 23, 2026Updated May 23, 2026

People

Open a person card to read their narrative notes, linked events, and location context inline.

Onel de Guzman

Suspect

Former AMA Computer College student publicly identified as the principal suspect and widely attributed author of the ILOVEYOU worm, though the case did not produce a straightforward criminal conviction under then-current Philippine law.

4 linked events2 sourcesPhilippines +2 more
Narrative notes
Narrative notes across 4 linked events

Former AMA Computer College student publicly identified as the principal suspect and widely attributed author of the ILOVEYOU worm, though the case did not produce a straightforward criminal conviction under then-current Philippine law.

PhilippinesManila, Metro ManilaAMA University (AMA Computer College main campus), Quezon City
Linked events
May 4, 2000• Philippines

ILOVEYOU begins global spread via Outlook email

The VBScript worm spreads worldwide through Microsoft Outlook using the subject "ILOVEYOU" and the attachment "LOVE-LETTER-FOR-YOU.TXT.vbs," quickly disrupting governments, companies, and home users.

  1. The message arrives with the subject "ILOVEYOU" and the attachment "LOVE-LETTER-FOR-YOU.TXT.vbs," exploiting filename conventions to make the attachment look like a harmless text file.
  2. Recipients open the attachment, launching VBScript code that copies itself into local files and prepares to spread outward.
  3. The malware uses Microsoft Outlook to send itself automatically to contacts in the victim's address book, multiplying the number of infections at extraordinary speed.
  4. Infected systems experience file overwrites, altered behavior, and credential-theft activity, turning a lure-based email attack into a broad operational disruption.
  5. Governments, companies, and personal users around the world begin shutting down mail systems and warning staff not to open the message.
May 5, 2000• Manila, Metro Manila

Philippine NBI targets local programmers

Investigators identify Onel de Guzman and Reonel Ramones as targets of a criminal probe connected to the ILOVEYOU worm.

  1. The National Bureau of Investigation shifts from outbreak response to authorship questions and begins tracing the worm back toward Manila.
  2. Investigators focus on individuals connected to AMA Computer College and related Manila-area leads, including Onel de Guzman and Reonel Ramones.
  3. Public reporting broadens into a multi-suspect frame rather than a single-offender conclusion, reflecting how early and fluid the attribution picture still is.
  4. Investigators and journalists begin connecting the outbreak to credential-theft ideas and to the rejected AMA thesis proposal that later becomes central to the case narrative.
May 1, 2000• AMA University (AMA Computer College main campus), Quezon City

Onel de Guzman emerges as the central public suspect

Reporting and investigative focus increasingly center on former AMA Computer College student Onel de Guzman as the suspected author or originator of the worm.

  1. Public attention shifts from the worm's immediate operational damage to the question of who actually wrote or released it.
  2. Onel de Guzman becomes the central public name because of the AMA connection, the password-theft motive narrative, and the thesis proposal discussed in reporting.
  3. The case begins to harden into an Onel-centered attribution story even though the formal legal path to proving authorship remains incomplete.
  4. Later reporting and interviews reinforce de Guzman's place at the center of the story, even while acknowledging the gap between public attribution and courtroom adjudication.
May 1, 2000• Philippines

Philippine legal gap limits immediate prosecution

Investigators and prosecutors confront the absence of a clear Philippine cybercrime statute directly covering the conduct exposed by the ILOVEYOU outbreak.

  1. Investigators and prosecutors confront the fact that the Philippines lacks a clearly applicable cybercrime statute matching the conduct exposed by the outbreak.
  2. That legal gap limits the state's ability to convert public attribution into a straightforward prosecution or conviction.
  3. The case becomes a high-profile example of how malware, credential theft, and mass network abuse had outrun the structure of existing criminal law.
  4. Reporting on dropped or constrained charges cements the distinction between strong public suspicion and incomplete legal resolution.

Reonel Ramones

Suspect

Bank employee and associate of Onel de Guzman who was arrested and questioned during the early Philippine investigation into the worm.

3 linked events2 sourcesManila, Metro Manila +1 more
Narrative notes
Narrative notes across 3 linked events

Bank employee and associate of Onel de Guzman who was arrested and questioned during the early Philippine investigation into the worm.

Manila, Metro ManilaPhilippines
Linked events
May 5, 2000• Manila, Metro Manila

Philippine NBI targets local programmers

Investigators identify Onel de Guzman and Reonel Ramones as targets of a criminal probe connected to the ILOVEYOU worm.

  1. The National Bureau of Investigation shifts from outbreak response to authorship questions and begins tracing the worm back toward Manila.
  2. Investigators focus on individuals connected to AMA Computer College and related Manila-area leads, including Onel de Guzman and Reonel Ramones.
  3. Public reporting broadens into a multi-suspect frame rather than a single-offender conclusion, reflecting how early and fluid the attribution picture still is.
  4. Investigators and journalists begin connecting the outbreak to credential-theft ideas and to the rejected AMA thesis proposal that later becomes central to the case narrative.
May 8, 2000• Manila, Metro Manila

Arrest of Reonel Ramones in Manila

NBI arrests bank employee Reonel Ramones; his girlfriend, Irene de Guzman, is also named during the operation.

  1. Authorities conduct raids in Manila and detain Reonel Ramones for questioning as the probe narrows around named associates.
  2. Irene de Guzman is also named in reporting tied to the operation, showing how the investigation still includes a network of relationships rather than only one central suspect.
  3. The arrest helps keep Ramones in the public narrative, but later histories of the case place much more emphasis on Onel de Guzman than on Ramones.
May 1, 2000• Philippines

Philippine legal gap limits immediate prosecution

Investigators and prosecutors confront the absence of a clear Philippine cybercrime statute directly covering the conduct exposed by the ILOVEYOU outbreak.

  1. Investigators and prosecutors confront the fact that the Philippines lacks a clearly applicable cybercrime statute matching the conduct exposed by the outbreak.
  2. That legal gap limits the state's ability to convert public attribution into a straightforward prosecution or conviction.
  3. The case becomes a high-profile example of how malware, credential theft, and mass network abuse had outrun the structure of existing criminal law.
  4. Reporting on dropped or constrained charges cements the distinction between strong public suspicion and incomplete legal resolution.

Irene de Guzman

Witness

Girlfriend of Reonel Ramones questioned by the NBI during early raids tied to the ILOVEYOU investigation.

1 linked event1 sourceManila, Metro Manila
Narrative notes
Narrative notes across 1 linked event

Girlfriend of Reonel Ramones questioned by the NBI during early raids tied to the ILOVEYOU investigation.

Manila, Metro Manila
Linked events
May 8, 2000• Manila, Metro Manila

Arrest of Reonel Ramones in Manila

NBI arrests bank employee Reonel Ramones; his girlfriend, Irene de Guzman, is also named during the operation.

  1. Authorities conduct raids in Manila and detain Reonel Ramones for questioning as the probe narrows around named associates.
  2. Irene de Guzman is also named in reporting tied to the operation, showing how the investigation still includes a network of relationships rather than only one central suspect.
  3. The arrest helps keep Ramones in the public narrative, but later histories of the case place much more emphasis on Onel de Guzman than on Ramones.

Read Next

Continue Exploring

These cases share themes, geography, or investigative context with the one you are viewing.

Black Dahlia

The 1947 murder of Elizabeth Short in Los Angeles remains one of America's most famous unsolved homicide cases.

Philippines

Open case file →

Daveggio-Michaud Minivan Murders

In 1997, James Daveggio and Michelle Michaud used a modified minivan to kidnap, torture, and murder victims in California and Nevada.

Open case file →

Green River Killings

The Green River killings were a long-running series of murders in Washington state that led to Gary Ridgway's conviction in one of America's largest serial-homicide investigations.

Open case file →