On January 12, 2024, Microsoft announced that it had been the target of a sophisticated cyber attack by a Russian state-sponsored group known as Midnight Blizzard (APT29). The group, which is also suspected of being behind the Solar Winds hack in 2020, used a technique called "password spray attack" to gain access to a small percentage of corporate email accounts. Microsoft said that the attackers were looking for information on its operations, but did not compromise any critical components such as customer environments, production systems, source code, or AI systems.
Microsoft's disclosure came in compliance with a new mandate from the U.S. Securities and Exchange Commission (SEC) that requires publicly-owned companies to promptly report any cyber incidents that could have a material impact on their business or reputation. The SEC issued the mandate in response to the growing number of cyberattacks on U.S. companies and government agencies by foreign adversaries.
Microsoft's security practices have been under scrutiny in the past, especially after the Solar Winds hack that exposed vulnerabilities in its software and cloud services. Microsoft has acknowledged the risk from well-resourced nation-state threat actors and has invested heavily in improving its security posture and capabilities. However, some experts and critics have questioned whether Microsoft is doing enough to protect its customers and users from cyber threats.
The impact of the Microsoft breach on its products is still unclear. Microsoft is one of the largest providers of software and cloud services to the U.S. government and many other organizations around the world. Despite the assurance that no crucial systems were accessed by the attackers, some customers may be concerned about the security and reliability of Microsoft's products. Microsoft has said that it will continue to investigate and respond to the incident and will provide updates as appropriate.