Microsoft has confirmed that it was the victim of a cybersecurity breach, as claimed by hacking organization Lapsus$ earlier this week. Redmond appeared to dismiss the incident as unimportant, claiming that it was already investigating the problem before the organization went public and downplaying the need of safe source code.
According to a blog post on the incident, Microsoft’s investigation revealed that a single account had been compromised, giving the attacker “limited access.”
When Lapsus$ publicly announced the intrusion, Microsoft’s team was already examining the compromised account, according to Microsoft.
Earlier this week, the organization released a dump comprising approximately 37GB of Microsoft data. Bing, Bing Maps, and Cortana source code were reportedly among the items seized.
Microsoft stated that it “does not rely on code secrecy as a security measure,” and that examining source code does not increase risk.
Microsoft also discussed some of the group’s preferred strategies, many of which aren’t often used by cybercriminals. Phone-based social engineering, SIM-swapping, gaining access to personal e-mail accounts, and even paying employees, suppliers, or business partners of target firms for access to credentials or MFA clearance are all examples.
Redmond also issued security suggestions for businesses and people, such as utilizing multi-factor authentication (MFA), avoiding phone-based MFA, and using passwordless authentication like Windows Hello, Microsoft Authenticator, or FIDO tokens.
This year, Lapsus$ has been particularly busy, having already struck major technology targets such as Nvidia, Samsung, and Vodafone. Okta, an authentication company, has also been hit, with the company amending its statement to reveal that roughly 2.5 percent of its clients’ data may have been read or “acted upon.”
To read our blog on “Samsung verifies the Galaxy source code has been stolen by hackers,” click here.