65,000+ Businesses Suffered Data Leaks Due to Microsoft Server Misconfiguration

Microsoft Server Misconfiguration allowed unauthenticated access to some business transaction data pertaining to exchanges between Microsoft and potential customers, such as the planning or possible deployment and provisioning of Microsoft services.

The exposure totals 2.4 gigabytes of data, which includes invoices, product orders, signed client papers, and partner ecosystem details, among other things.

Microsoft has disputed the scope of the problem, claiming that the information contained names, email addresses, email content, company names, phone numbers, and associated files relevant to business “Between a customer and Microsoft or an approved Microsoft partner.”

Microsoft did not disclose the size of the data breach, but according to SOCRadar, it impacted more than 65,000 businesses in 111 countries. The exposure totals 2.4 gigabytes of data, which includes invoices, product orders, signed client papers, and partner ecosystem details, among other things.

“The exposed data includes files ranging from 2017 through August 2022,” according to SOCRadar.

Microsoft’s inability to tell consumers what data was obtained and evidently failed to alert authorities – a legal duty – has all the elements of a significant bungled response, security researcher Kevin Beaumont tweeted.

Microsoft, on the other hand, has contested the scope of the problem, claiming that the data contained names, email addresses, email content, firm name, and phone numbers, as well as attached files relevant to business “between a customer and Microsoft or an approved Microsoft partner.”

In addition, the threat intelligence firm “greatly overstated” the scale of the problem, according to the disclosure, because the data collection included “duplicate material, with repeated references to the same emails, projects, and people.”

There is no indication that threat actors unlawfully accessed the material prior to its dissemination. Nevertheless, such leaks can be used for nefarious purposes such as extortion, social engineering assaults, or a fast profit.

However, this information might be helpful for future attackers looking for weaknesses in the networks of one of these firms.

Sharing is Caring!

You are welcome to put this blog article on your website, provided you also append an active link to our website “Source: https://resources.rhyno.io”

For media enquiries, contact us at [email protected].