Microsoft Downplays Scope of Email Attack

Microsoft on Monday maintained that an incident reported over the weekend about an unknown attacker using a customer support agent's credentials to access email content belonging to users of MSN, Outlook, and Hotmail accounts, affected only a limited number of users.

In initial comments on Saturday to TechCrunch—the first to report on the intrusion—Microsoft confirmed that email accounts belonging to just a few users had been compromised.

The company said the attackers had not accessed or viewed the actual content of the emails or any attachments. Instead, only certain other information related to a user's account such as the email address, subject lines, email folders, and email addresses of people the user has communicated with, had been viewed or accessed.

An email from Microsoft to one of the victims that was later posted Saturday to Reddit, described the unauthorized access as lasting from Jan. 1, 2019 and March 28, 2019. The letter warned the user to be wary about phishing attempts while noting that Microsoft had no idea why the intruders might have viewed the email information or how it might have been used. Microsoft immediately disabled the stolen credentials preventing further misuse the company said.

In later comments, including those made to Dark Reading today, Microsoft admitted that the intruders had actually accessed and viewed email content in some cases. The company did not provide any specifics on the number of users that might have had their email accounts compromised in this manner, however.

"Our notification to the majority of those impacted noted that bad actors would not have had unauthorized access to the content of e-mails or attachments," a Microsoft spokesperson said. However, with approximately 6% of the already "limited subset" of users overall that were impacted, the attackers had unauthorized access to email content as well.

"We addressed this scheme, which affected a limited subset of consumer accounts, by disabling the compromised credentials and blocking the perpetrators' access," the company said. Microsoft also has increased detection and monitoring of the impacted email accounts out of an abundance of caution.

Questions Remain

The relatively scant details from Microsoft about the intrusion is prompting questions about how attackers might have obtained the support agent's credentials, why the breach remained undetected for close to three months, how the company discovered it, and what the intruders might have been after.

Similarly, it's unclear if the support agent was specifically targeted because of the access that his or her credentials provided to customer email information.

"This breach, albeit seemingly fairly limited in scope, still follows a familiar pattern," said David Higgins, technical director at CyberArk. "Attackers compromised privileged credentials in order to gain greater access to wider customer data." The takeaway for enterprises is to pay more attention to administrator accounts and to accounts with privileged access to sensitive customer and business data.

Attacks involving the use of valid credentials can be very hard to detect, added Tim Erlin, vice president of product management and strategy at Tripwire. So it is important for organization to ensure and enforce separation of duties to mitigate the scope of attacks such as the one on Microsoft he said.

"While there’s a certain amount of schadenfreude in discussing the security failings of a company like Microsoft, these types of incidents should really force every organization to evaluate how they've implemented their own security controls," Erlin said.

News of the Microsoft email hack somewhat ironically enough came just days after news about Yahoo reaching a $117.5 million accord with victims of breaches at the company that ended up exposing email addresses, passwords, and other data of some 3 billion users.

Related Content:

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.