Microsoft Downplays Scope of Email Attack

An unknown attacker used a support agents credentials to access email content belonging to some Outlook, Hotmail users.

Microsoft on Monday maintained that an incident reported over the weekend about an unknown attacker using a customer support agents credentials to access email content belonging to users of MSN, Outlook, and Hotmail accounts, affected only a limited number of users.
In initial comments on Saturday to
TechCrunch
—the first to report on the intrusion—Microsoft confirmed that email accounts belonging to just a few users had been compromised.
The company said the attackers had not accessed or viewed the actual content of the emails or any attachments. Instead, only certain other information related to a users account such as the email address, subject lines, email folders, and email addresses of people the user has communicated with, had been viewed or accessed.
An email from Microsoft to one of the victims that was later posted Saturday to
Reddit
, described the unauthorized access as lasting from Jan. 1, 2019 and March 28, 2019. The letter warned the user to be wary about phishing attempts while noting that Microsoft had no idea why the intruders might have viewed the email information or how it might have been used. Microsoft immediately disabled the stolen credentials preventing further misuse the company said.
In later comments, including those made to Dark Reading today, Microsoft admitted that the intruders had actually accessed and viewed email content in some cases. The company did not provide any specifics on the number of users that might have had their email accounts compromised in this manner, however.
Our notification to the majority of those impacted noted that bad actors would not have had unauthorized access to the content of e-mails or attachments, a Microsoft spokesperson said. However, with approximately 6% of the already limited subset of users overall that were impacted, the attackers had unauthorized access to email content as well.
We addressed this scheme, which affected a limited subset of consumer accounts, by disabling the compromised credentials and blocking the perpetrators access, the company said. Microsoft also has increased detection and monitoring of the impacted email accounts out of an abundance of caution.
Questions Remain
The relatively scant details from Microsoft about the intrusion is prompting questions about how attackers might have obtained the support agents credentials, why the breach remained undetected for close to three months, how the company discovered it, and what the intruders might have been after.
Similarly, its unclear if the support agent was specifically targeted because of the access that his or her credentials provided to customer email information.
This breach, albeit seemingly fairly limited in scope, still follows a familiar pattern, said David Higgins, technical director at CyberArk. Attackers compromised privileged credentials in order to gain greater access to wider customer data. The takeaway for enterprises is to pay more attention to administrator accounts and to accounts with privileged access to sensitive customer and business data.
Attacks involving the use of valid credentials can be very hard to detect, added Tim Erlin, vice president of product management and strategy at Tripwire. So it is important for organization to ensure and enforce separation of duties to mitigate the scope of attacks such as the one on Microsoft he said.
While there’s a certain amount of schadenfreude in discussing the security failings of a company like Microsoft, these types of incidents should really force every organization to evaluate how theyve implemented their own security controls, Erlin said.
News of the Microsoft email hack somewhat ironically enough came just days after news about Yahoo reaching a $117.5 million accord with victims of breaches at the company that ended up exposing email addresses, passwords, and other data of some 3 billion users.
Related Content:
773 Million Email Addresses, 21 Million Passwords For Sale on Hacker Forum
Yahoo Reaches $117.5M Breach Accord Following Failed Settlement
Beyond Passwords: Why Your Company Should Rethink Authentication
6 Reasons Why Employees Violate Security Policies

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industrys most knowledgeable IT security experts. Check out the
Interop agenda
here.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Microsoft Downplays Scope of Email Attack