Moment Attack on Microsoft by Russian hackers had a greater effect than originally reported. The tech giant is notifying additional people that emails between them and Microsoft have been accessed, Bloomberg reports. A group known as Midnight Blizzard or Nobelium orchestrated this attack along with the 2020 SolarWinds hack. The US government has previously linked Midnight Blizzard to the Russian Foreign Intelligence Service.
Microsoft previously notified some individuals that their emails were being viewed, but the company is now sharing the details. “This week we are continuing to notify customers who corresponded with Microsoft corporate email accounts. Midnight Blizzard A Microsoft spokesperson said that the emails obtained by this actor are available to customers. “This is enhanced detail for customers who have already received notifications and also includes new notifications.” Microsoft informs customers through this tool. The email initially raised concerns that the notice was a phishing scam.
Microsoft first disclosed the hack in January, saying that a password spray attack gave the group access to “a very small subset of Microsoft corporate email accounts” in late 2023. Employees whose emails were hacked included members of senior management, cybersecurity and legal teams.
Microsoft said at the time that vulnerabilities in its systems were not to blame for the attack, but that it would improve security. However, the US government brought the heat on Microsoft with a March report Cyber Security Review Board finding was the company’s “safety culture insufficient and requires major repairs.” In April US Cybersecurity and Infrastructure Security Agency (CISA) issued an order requiring federal agencies to analyze hacked emails and secure Microsoft cloud accounts, among other measures. CISA has alerted all affected institutions and asked them to provide regular updates on steps taken to prevent this “serious and unacceptable risk”.
