Breachesby GlyphMicrosoft
Disclosed Sep 18, 2023Unverified
AI research team's overly permissive SAS token exposed 38TB of internal data
A Microsoft AI research GitHub repo shared an Azure SAS token that granted access to a whole storage account, exposing 38TB including workstation backups of 359 employees, secrets, private keys, passwords and over 30,000 Teams messages. Wiz reported it in June 2023 and the token was revoked two days later.
What is known
| People affected | Not stated in the sources we have |
|---|---|
| Disclosed | Sep 18, 2023 |
| Discovered | Jun 22, 2023 |
| Attack | Exposed data |
| Data exposed | Credentials and tokensInternal documentsMessagesPasswords |
| Sector | Tech · US |
| Status | Unverified: not yet confirmed by an official notice, a filing or the organization |
Sources
Notices filed
Other breaches at Microsoft
Hijacked Microsoft GitHub repos pushed password stealers to AI coding tool usersSupply chain exposed credentials and tokens and passwords.Supply chainTechUSUnverifiedJun 8Microsoft 365 Copilot Chat bug processed confidential-labeled emails for weeksAI or model exposed messages.AI or modelTechUSUnverifiedFeb 18Storm-2139 used stolen customer credentials to hijack Azure OpenAI accountsCredential stuffing exposed source code, API keys, credentials and tokens and internal documents.Credential stuffingTechUSFeb 26, 2025Russian state hackers access Microsoft senior leadership email accountsHacking exposed emails, messages, internal documents and source code. Reported to the SEC 8-K.HackingTechUSJan 19, 2024China-based Storm-0558 forges tokens with stolen Microsoft key to read government emailHacking exposed emails and messages.HackingTechUSJul 11, 2023Misconfigured Microsoft storage exposes prospective customer business dataExposed data exposed names, emails, phone numbers and internal documents.Exposed dataTechUSUnverifiedOct 19, 2022Lapsus$ compromises a Microsoft account and leaks Bing and Cortana source codeHacking exposed source code.HackingTechUSMar 22, 2022Hafnium exploits Exchange Server zero-days to breach on-premises mail serversHacking exposed emails, credentials and tokens and messages.HackingTechUSMar 2, 2021SolarWinds attackers view Microsoft source code repositoriesSupply chain exposed source code.Supply chainTechUSDec 31, 2020
History of this record
First recordedby seedSource
First seen 2026-09-25 (Research). Record counts are as reported. Not legal advice.