Patcay.com – A cyberattack by Russian hackers on Microsoft has turned out to be more extensive than previously reported.
The tech giant has once again informed users that their emails have been accessed by a third party.
The hacker group known as Midnight Blizzard or Nobelium, which was previously involved in the 2020 SolarWinds hack, is suspected to be behind this attack.
Read more : Twilio: The Importance of Ethical AI in Creating Better Customer Experiences
The United States government has linked Midnight Blizzard to the Russian Foreign Intelligence Service.
Microsoft had previously notified some users that their emails had been compromised, but the company is now providing more detailed information.
“This week, we are continuing to notify customers who were involved in correspondence with the Microsoft corporate email accounts that have been exfiltrated by Midnight Blizzard hackers. We are also providing customers with the email correspondence that was accessed by this actor,” a Microsoft spokesperson said.
“This is an increase in detail for customers who were previously notified, as well as new notifications,” the spokesperson added.
Microsoft sent these notifications via email, initially causing concerns that the emails were phishing scams.
Microsoft first disclosed the hack in January 2024, stating that a password attack had allowed the hacker group to access a “very small percentage of Microsoft corporate email accounts” at the end of 2023.
Employees whose emails were compromised included senior leadership, cybersecurity, and legal teams.
At that time, Microsoft said that vulnerabilities in its system were not the cause of the attack but that they would enhance security measures.
However, the US government has tried to pressure Microsoft, with a report from the Cyber Safety Review Board in March stating that the “company’s security culture is inadequate and needs improvement.”
In April, the US Cybersecurity and Infrastructure Security Agency (CISA) issued an order requiring federal agencies to analyze the hacked emails and secure Microsoft cloud accounts, among other measures.
CISA notified all affected agencies and requested them to provide regular updates on the steps being taken to address this serious risk.