Microsoft Customer Data Exposed by Misconfigured Server

Due to this error, hackers gained unauthorized access to some business transaction data related to exchanges between Microsoft and potential clients. The data exposed is related to the planning, potential implementation, and provisioning of Microsoft services.

Furthermore, Microsoft stated that there was no evidence that any customer accounts or systems were compromised.

SOCradar researchers claimed to have found 2.4TB of Microsoft customer data, largely emails and project files. The data exposed contained statements of work documents, project details, product orders, invoices, personally identifiable information, price lists, and intellectual property documents.

The researchers claimed that the information in the exposed data could be linked to over 65,000 entities from 111 countries.

Microsoft responded by accusing the researchers of exaggerating the scope of the breach. They added that releasing a search tool to browse the data was not in the best interest of protecting consumer privacy or security and might put them in unnecessary danger.

Threat actors who may have accessed the data could use this information in different forms for extortion, blackmail, and practice social engineering tactics. They can simply try to sell the information to the highest bidder on the dark web and Telegram channels.

Users must be watchful of unsolicited texts, and emails. Avoid clicking on links that come from an unknown source or look unconvincing. Besides, organizations must stay protected through regular patch updates.