the Melissa virus
loresecurity
The March 1999 Word-macro virus that mailed itself to the first 50 Outlook contacts and buried corporate email worldwide.
David L. Smith released Melissa on March 26, 1999, hiding it in a Word document; each opened copy mass-mailed itself onward, and the exponential flood forced companies including Microsoft to shut off outbound email. Smith, who named it after a dancer, was traced within days and sentenced to prison. Melissa marked the moment email itself became the malware transport of choice.
Melissa arrived in March 1999 as a Word document containing a macro, which mailed itself to the first fifty entries of the victim's address book. The volume of mail it generated was enough to force major organizations to shut down their mail systems entirely, which was the actual damage.
What it demonstrated was that document formats are executable. A macro language embedded in an office suite for automation is a programming environment attached to a file type that everyone treats as data, and that gap between how a file is perceived and what it can do had not been widely internalized. Documents were things you opened without thinking, and Melissa is where that stopped being safe.
The response shaped a decade of enterprise policy: macros disabled by default, prompts before enabling, signed macros for legitimate internal tools, and eventually blocking macro-enabled documents from the internet entirely. That last change came more than twenty years later, which is a reasonable measure of how long it takes to remove a capability that some part of a business genuinely depends on.