In February 2024, Microsoft Azure experienced a significant security incident affecting various executive accounts. Attackers managed to access certain applications through unauthorized means, targeting executives with the intent of financial and data theft. Around the same time, another security concern arose involving an unprotected server associated with Microsoft's Bing search engine, which was subsequently secured in March 2024.

How many accounts were compromised?

The breach impacted over 50 executive accounts.

What data was leaked?

The data exposed in the breach included critical user data, sensitive emails from US government officials, and internal passwords, keys, and credentials of Microsoft employees.

How was Azure hacked?

Attackers breached Microsoft Azure by using credential theft through phishing methods and cloud account takeover, targeting mid-level and senior executives for financial fraud and data theft. The infiltration involved malicious links embedded in documents, leading to phishing websites. Specific malware related to the breach remains unclear.

Azure's solution

In response to the hack, Azure's specific enhanced security measures remain unclear due to limited information. However, it is known that Microsoft took steps to lock down an unprotected server hosting sensitive data related to Bing search engine. While the company is reportedly overhauling its security practices, details on the removal of malware, backdoors, and collaboration with cybersecurity experts are not available.

How do I know if I was affected?

Azure has not explicitly mentioned reaching out to affected users. If you're an Azure user and haven't received a notification, you may visit Have I Been Pwned to check your credentials.

What should affected users do?

In general, affected users should:

• Change Your Passwords: Immediately update your passwords for all affected accounts. Make sure the new passwords are strong and unique, not previously used on any other platform.

• Reset Passwords for Other Accounts: If you've used the same or similar passwords for other online accounts, reset those as well. This is crucial as attackers often try using stolen passwords on multiple sites.

• Enable Two-Factor Authentication (2FA): Activate 2FA on all affected accounts. Consider enabling this additional security feature on all other important online accounts to significantly reduce the risk of unauthorized access.

For more specific help and instructions, please contact Azure Support directly.

Where can I go to learn more?

If you want to find more information on the Azure data breach, check out the following news articles:

• Microsoft Azure Hit With The Largest Data Breach In Its History; Hundreds Of Executive Accounts Compromised

• Microsoft left internal passwords exposed in latest security blunder - The Verge