Business Maverick

Business Maverick

US warns agencies of possible breach via Microsoft hack

US warns agencies of possible breach via Microsoft hack
A Microsoft store in New York. The US has warned agencies of a possible breach via a Microsoft hack.

US federal agencies were ordered to analyse emails, reset compromised credentials and work to secure Microsoft Corp. cloud accounts amid concerns that a Russian nation-state hacking group may have accessed some correspondence.

The directive from the US Cybersecurity and Infrastructure Security Agency, known as CISA, came in response to a breach of Microsoft that the tech giant disclosed in January. A Russian state-sponsored group called Midnight Blizzard was accused of exfiltrating data from Microsoft and using it to try to compromise some of the company’s customers, according to the CISA alert. That includes correspondence between federal agencies and Microsoft, according to CISA.

The emergency directive was initially issued on 2 April and made public on Thursday.

Microsoft and CISA have notified all federal agencies whose emails may have been compromised by the hacking group, according to the government directive. It didn’t disclose the names or number of agencies.

The incident represents a “grave and unacceptable risk” to agencies, according to the directive.

A spokesperson for the Russian Embassy in Washington didn’t immediately respond to a request for comment.

Asked if the hacking campaign had been stopped, Eric Goldstein, executive assistant director at CISA, said the group poses a “persistent threat to organisations public and private”.

Federal agencies have until April 30 to reset credentials for related applications, and are also required to identify affected email correspondence by that deadline as well.

In January, Microsoft said it had been warning organisations that they were targets of the same Russian-sponsored group that hacked into sensitive corporate email accounts last year. The hackers — also known as Cozy Bear — have been identified by Microsoft’s threat intelligence team as the same cyber-espionage group that “has been targeting other organisations,” according to the January blog post.

Hewlett Packard Enterprise Co. also reported in January that it suffered a breach of its cloud-based email system that it said was likely caused by Midnight Blizzard.

The new US directive was previously reported by security news site CyberScoop.


Comments - Please in order to comment.

Please peer review 3 community comments before your comment can be posted


This article is free to read.

Sign up for free or sign in to continue reading.

Unlike our competitors, we don’t force you to pay to read the news but we do need your email address to make your experience better.

Nearly there! Create a password to finish signing up with us:

Please enter your password or get a sign in link if you’ve forgotten

Open Sesame! Thanks for signing up.