On the heels of a trove of 773 million emails, and of millions of passwords, from a variety of domains getting leaked in January, Microsoft has faced another breach affecting its web-based email services.
According to an email Microsoft has sent out to affected users (the reader who tipped us off his late Friday evening), malicious hackers were potentially able to access an affected user's e-mail address, folder names, the subject lines of e-mails, and the names of other email addresses the user communicates with ̵
Microsoft is definitely recommending that users change their passwords regardless
The breach occurred between January 1 and March 28 Microsoft's letter to users said.
The hackers got into the system at compromising a customer support agent's credentials, according to the letter. Once identified, those credentials were disabled. Microsoft customs users that did not know what data was viewed by the hackers or why, but users might see more phishing or spam emails as a result. “You should be careful when receiving any e-mails from any misleading domain name, any e-mail that requests personal information or payment, or any unsolicited request from an untrusted source.”
We are printing the full text of the email below, but have a separate email sent to us, from Microsoft's Information Protection and Governance team, confirmed some of the basic details, adding that it has increased detection and monitoring on those accounts.
Access to some customers' web-based email accounts by cybercriminals. We address this scheme by disabling the compromised credentials to the limited set of targeted accounts, while also blocking the perpetrators' access. A limited number of consumer accounts were impacted, and we have notified all impacted customers. Out of an abundance of caution, we also increased detection and monitoring to further protect affected accounts.
No business customers affected, TechCrunch understands
Right now, a lot of question marks remain. It's unclear exactly how many people or accounts were affected, nor in which territories they are located – but it seems that at least some were in the European Union, since Microsoft also provides information for contacting Microsoft's data protection officer in the region.
We also do not know how the agent's credentials were compromised, or if the agent was a Microsoft employee, or if the person worked for a third party providing support services. And Microsoft has not explained how it discovered the breach.
We have asked Microsoft all of the above and will update this post as we learn more.
In this age where cybersecurity breaches get revealed on a daily basis, email is one of the most commonly leaked pieces of personal information. There is also a site created dedicated to helping people figure out if they are among those who have been hacked. Have I Been Pwned, as the site is called, now has over 7.8 billion email addresses in its database.
We'll update this post as we learn more. The letter from Microsoft to users follows
Microsoft is committed to providing our customers with transparency. As part of this trust and commitment to you, we are informing you of a recent event that affected your Microsoft-managed email account.
We have identified that a Microsoft support agent's credentials were compromised, enabling individuals outside of Microsoft to access information within your Microsoft email account. This unauthorized access may have allowed unauthorized parties to access and / or view information related to your email account (such as your e-mail address, the names of the e-mails, and the names of other e-mail addresses you communicate with), but not the content of any emails or attachments, between January 1 st 2019 and March 28 th 2019.
Upon awareness of this issue, Microsoft immediately The compromised credentials are disabled, prohibiting their use for any further unauthorized access. Our data shows that account-related information (but not the content of any e-mails) could have been viewed, but Microsoft has no indication why that information was viewed or how it may have been used. As a result, you may receive phishing emails or other spam mails. You should be careful when receiving any e-mails from any misleading domain name, any e-mail that requests personal information or payment, or any unsolicited request from an untrusted source (you can read more about phishing attacks at https: // docs. microsoft.com/en-us/windows/security/threat-protection/intelligence/phishing).
It is important to note that your email login credentials were not directly affected by this incident. However, you should reset your password for your account.
If you need further assistance, please feel free to reach out to our incident response team at ipg-ir @ microsoft. com. If you are a citizen of European Union, you may also contact Microsoft's Data Protection Officer at:
EU Data Protection Officer
Microsoft Ireland Operations Ltd
One Microsoft Place,
South County Business Park,
Leopardstown, Dublin 18, Ireland
Microsoft regrets any inconvenience caused by this issue. Please be assured that Microsoft takes data protection very seriously and has engaged its internal security and privacy teams in the investigation and resolution of the issue, as well as additional hardening of systems and processes to prevent such recurrence.