Microsoft microsoft.com Microsoft data breach 2024: what happened and what to do
In January 2024 Microsoft said a Russian state-backed group it calls Midnight Blizzard read email from senior leaders and some staff. The activity began in November 2023 and Microsoft detected it on January 12, 2024. Microsoft says it found no sign that customer-facing systems were compromised.
View all 13,177 breaches- Breach date
- Nov 2023
- Made public
- 19 Jan 2024
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
On January 19, 2024, Microsoft said it had detected an attack by Midnight Blizzard, a Russian state-backed group that Microsoft also calls Nobelium. Microsoft's security team found it on January 12, 2024. Microsoft's first post says the activity started in November 2023, when the group used a password spray attack (trying common passwords across many accounts) against a legacy non-production test account.
The group used that account to reach a very small percentage of Microsoft corporate email accounts. Microsoft says they included members of its senior leadership team and employees in cybersecurity, legal and other functions. Axios reported the disclosure the same day.
Sources checked: msrc.microsoft.com, axios.com, consumer.ftc.gov
Last verified against the official page:
What was exposed
Microsoft says some emails and attached documents were taken. At first it said it had seen no sign of access to customer environments, source code or AI systems. In an update on March 8, 2024, it said the group had used information from the stolen email to get into some source code repositories and internal systems. It also said it had found no evidence that customer-facing systems hosted by Microsoft were compromised.
Microsoft has not published a number of affected people, and this page does not give one. It did say it was contacting customers whose shared secrets (such as login credentials) appeared in the stolen email.
What it means for you
This was an attack on a company's internal systems, not a leak of consumer account records. If you are a Microsoft customer who did not hear from Microsoft, nothing in its public statements says your account was touched. The practical risk is phishing that mentions the incident. The FTC explains how to spot phishing.
Microsoft's response
Microsoft started its response process after detecting the intrusion on January 12, 2024. In its March update it reported a sharp rise in password spray attacks in February 2024 and said it was contacting affected customers.
What to do if you were in it
- 1
Check for a notice from Microsoft
Microsoft said it was contacting customers whose shared secrets were in the stolen email. If you run a business account and got one, follow its steps and rotate the credentials it names.
- 2
Be wary of messages that mention this incident
Scammers use big news stories as bait. Don't click links in unexpected emails or texts, and sign in by typing the address yourself, as the FTC advises.
- 3
Turn on multi-factor authentication
The attackers got in by guessing a password on a test account. CISA recommends multi-factor authentication on all accounts that offer it, starting with email.
- 4
Check whether your email or phone is in this and other breaches
Run a free scan with Serus to see if your details appear in known breaches. Serus monitors breach databases and the dark web and alerts you, but it can't remove breach data.
Timeline
-
The breach happened
-
The company made it public
Frequently asked
Was I affected by the Microsoft breach?
Microsoft's statements describe accessed corporate email and internal systems, not consumer account records. It said it was contacting affected customers directly.
What was exposed?
Microsoft says some emails and attached documents were taken. In March 2024 it said some source code repositories and internal systems were also reached.
Should I change my Microsoft password?
Microsoft has not said consumer passwords were taken. If you reuse a password across sites, change it anyway and turn on multi-factor authentication.
Sources
- msrc.microsoft.com/blog/2024/01/microsoft-actions-following-attack-by-nation-state-actor-midnight-blizzard/
- msrc.microsoft.com/blog/2024/03/update-on-microsoft-actions-following-attack-by-nation-state-actor-midnight-blizzard/
- axios.com/2024/01/19/russian-hackers-breach-microsoft-leaders-email-accounts
- consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams
- cisa.gov/MFA
Something wrong or out of date? Tell us and we'll re-check it.
