TRUE CRIME ATLAS
← Back to all cases

ILOVEYOU Virus

New releasePublished May 23, 2026Updated May 23, 2026
May 4, 2000

ILOVEYOU begins global spread via Outlook email

The VBScript worm spreads worldwide through Microsoft Outlook using the subject "ILOVEYOU" and the attachment "LOVE-LETTER-FOR-YOU.TXT.vbs," quickly disrupting governments, companies, and home users.

View sequence of events
  1. early morning
    The message arrives with the subject "ILOVEYOU" and the attachment "LOVE-LETTER-FOR-YOU.TXT.vbs," exploiting filename conventions to make the attachment look like a harmless text file.
  2. same day
    Recipients open the attachment, launching VBScript code that copies itself into local files and prepares to spread outward.
  3. same day
    The malware uses Microsoft Outlook to send itself automatically to contacts in the victim's address book, multiplying the number of infections at extraordinary speed.
  4. same day
    Infected systems experience file overwrites, altered behavior, and credential-theft activity, turning a lure-based email attack into a broad operational disruption.
  5. within hours
    Governments, companies, and personal users around the world begin shutting down mail systems and warning staff not to open the message.
May 4, 2000

Early technical alerts and analysis posted

Security mailing lists publish dissection of the email’s subject, body text, and dangerous attachment behavior, warning Outlook users not to open it.

View sequence of events
  1. 11:55
    A Bugtraq posting identifies the "ILOVEYOU" subject line and the VBS attachment as immediate indicators of compromise.
  2. same day
    Security analysts describe how the worm propagates through Outlook and warn administrators to block the attachment before more users execute it.
  3. same day
    Early technical notes emphasize that the threat is not just an email prank but a self-mailing script capable of modifying files and spreading recursively.
  4. same day
    Those early advisories help establish the core forensic narrative later used in media coverage, hearings, and incident-response documentation.
May 5, 2000

Philippine NBI targets local programmers

Investigators identify Onel de Guzman and Reonel Ramones as targets of a criminal probe connected to the ILOVEYOU worm.

View sequence of events
  1. early in the investigation
    The National Bureau of Investigation shifts from outbreak response to authorship questions and begins tracing the worm back toward Manila.
  2. same day
    Investigators focus on individuals connected to AMA Computer College and related Manila-area leads, including Onel de Guzman and Reonel Ramones.
  3. same day
    Public reporting broadens into a multi-suspect frame rather than a single-offender conclusion, reflecting how early and fluid the attribution picture still is.
  4. same day
    Investigators and journalists begin connecting the outbreak to credential-theft ideas and to the rejected AMA thesis proposal that later becomes central to the case narrative.
May 8, 2000

Arrest of Reonel Ramones in Manila

NBI arrests bank employee Reonel Ramones; his girlfriend, Irene de Guzman, is also named during the operation.

View sequence of events
  1. during coordinated raids
    Authorities conduct raids in Manila and detain Reonel Ramones for questioning as the probe narrows around named associates.
  2. same operation
    Irene de Guzman is also named in reporting tied to the operation, showing how the investigation still includes a network of relationships rather than only one central suspect.
  3. same day
    The arrest helps keep Ramones in the public narrative, but later histories of the case place much more emphasis on Onel de Guzman than on Ramones.
May 1, 2000

Onel de Guzman emerges as the central public suspect

Reporting and investigative focus increasingly center on former AMA Computer College student Onel de Guzman as the suspected author or originator of the worm.

View sequence of events
  1. as the first wave of reporting settles
    Public attention shifts from the worm's immediate operational damage to the question of who actually wrote or released it.
  2. same period
    Onel de Guzman becomes the central public name because of the AMA connection, the password-theft motive narrative, and the thesis proposal discussed in reporting.
  3. same period
    The case begins to harden into an Onel-centered attribution story even though the formal legal path to proving authorship remains incomplete.
  4. retrospectively
    Later reporting and interviews reinforce de Guzman's place at the center of the story, even while acknowledging the gap between public attribution and courtroom adjudication.
May 1, 2000

Philippine legal gap limits immediate prosecution

Investigators and prosecutors confront the absence of a clear Philippine cybercrime statute directly covering the conduct exposed by the ILOVEYOU outbreak.

View sequence of events
  1. as charging decisions are assessed
    Investigators and prosecutors confront the fact that the Philippines lacks a clearly applicable cybercrime statute matching the conduct exposed by the outbreak.
  2. same period
    That legal gap limits the state's ability to convert public attribution into a straightforward prosecution or conviction.
  3. same period
    The case becomes a high-profile example of how malware, credential theft, and mass network abuse had outrun the structure of existing criminal law.
  4. later in 2000
    Reporting on dropped or constrained charges cements the distinction between strong public suspicion and incomplete legal resolution.
Jun 1, 2000

Electronic commerce reform follows the outbreak

The case becomes part of the pressure for new Philippine legal frameworks addressing electronic transactions and cyber-enabled misconduct.

View sequence of events
  1. after the outbreak's first shockwave
    The worm's global impact turns cybercrime reform into an urgent policy issue in the Philippines and abroad.
  2. June 2000
    The Electronic Commerce Act becomes part of the immediate legislative response environment, addressing hacking and related electronic offenses more directly than before.
  3. longer-term aftermath
    Later legal frameworks, including broader cybercrime statutes, are often discussed in the shadow of ILOVEYOU as an example of why legacy law was inadequate.

Read Next

Continue Exploring

These cases share themes, geography, or investigative context with the one you are viewing.

Black Dahlia

The 1947 murder of Elizabeth Short in Los Angeles remains one of America's most famous unsolved homicide cases.

Philippines

Open case file →

Daveggio-Michaud Minivan Murders

In 1997, James Daveggio and Michelle Michaud used a modified minivan to kidnap, torture, and murder victims in California and Nevada.

Open case file →

Green River Killings

The Green River killings were a long-running series of murders in Washington state that led to Gary Ridgway's conviction in one of America's largest serial-homicide investigations.

Open case file →