Skip to content

Microsoft

Disclosed Mar 22, 20224 years agoConfirmed

Official notice

Lapsus$ compromises a Microsoft account and leaks Bing and Cortana source code

Microsoft confirmed that the group it tracks as DEV-0537 (Lapsus$) gained limited access through a single compromised account and published partial source code for products such as Bing and Cortana. Microsoft said no customer code or data was involved.

What is known

People affectedNot stated in the sources we have
DisclosedMar 22, 2022
AttackHacking
Data exposedSource code
SectorTech · US
StatusConfirmed

Sources

Notices filed

WhereFiledPeople
ResearchtotalMar 22, 2022

Other breaches at Microsoft

BreachAffected
Hijacked Microsoft GitHub repos pushed password stealers to AI coding tool usersJun 83 months agoSupply chainUnverifiedUnknown
Microsoft 365 Copilot Chat bug processed confidential-labeled emails for weeksFeb 187 months agoAI or modelUnverifiedUnknown
Storm-2139 used stolen customer credentials to hijack Azure OpenAI accountsFeb 26, 20251 year agoCredential stuffingUnknown
Russian state hackers access Microsoft senior leadership email accountsJan 19, 20242 years agoHackingUnknown
AI research team's overly permissive SAS token exposed 38TB of internal dataSep 18, 20233 years agoExposed dataUnverifiedUnknown
China-based Storm-0558 forges tokens with stolen Microsoft key to read government emailJul 11, 20233 years agoHackingUnknown
Misconfigured Microsoft storage exposes prospective customer business dataOct 19, 20223 years agoExposed dataUnverifiedUnknown
Hafnium exploits Exchange Server zero-days to breach on-premises mail serversMar 2, 20215 years agoHackingUnknown
SolarWinds attackers view Microsoft source code repositoriesDec 31, 20205 years agoSupply chainUnknown
History of this record
  • 2026-09-25 · added · seed source

First seen 2026-09-25 (Research), confirmed by Research. Record counts are as reported. Not legal advice.

Everything about Microsoft

New breaches by email

Wednesdays, only in weeks with newly disclosed breaches, the largest first.

Double opt-in. Unsubscribe any time.