Skip to content
Breaches.

Microsoft

Disclosed Feb 18, 20267 months agoUnverified

Microsoft 365 Copilot Chat bug processed confidential-labeled emails for weeks

Microsoft confirmed a bug (CW1226324) that let Microsoft 365 Copilot Chat read and summarize draft and sent emails carrying confidential labels since January 2026, bypassing customers' data loss prevention policies. A fix began rolling out in February.

What is known

People affectedNot stated in the sources we have
DisclosedFeb 18, 2026
AttackAI or model
Data exposedMessages
SectorTech · US
StatusUnverified: not yet confirmed by an official notice, a filing or the organization

Sources

Source
Microsoft says Office bug exposed customers' confidential emails to Copilot AItechcrunch.com · News

Notices filed

WhereFiledPeople
ResearchtotalFeb 18

Other breaches at Microsoft

BreachAffected
Hijacked Microsoft GitHub repos pushed password stealers to AI coding tool usersJun 83 months agoSupply chainUnverifiedUnknown
Storm-2139 used stolen customer credentials to hijack Azure OpenAI accountsFeb 26, 20251 year agoCredential stuffingUnknown
Russian state hackers access Microsoft senior leadership email accountsJan 19, 20242 years agoHackingUnknown
AI research team's overly permissive SAS token exposed 38TB of internal dataSep 18, 20233 years agoExposed dataUnverifiedUnknown
China-based Storm-0558 forges tokens with stolen Microsoft key to read government emailJul 11, 20233 years agoHackingUnknown
Misconfigured Microsoft storage exposes prospective customer business dataOct 19, 20223 years agoExposed dataUnverifiedUnknown
Lapsus$ compromises a Microsoft account and leaks Bing and Cortana source codeMar 22, 20224 years agoHackingUnknown
Hafnium exploits Exchange Server zero-days to breach on-premises mail serversMar 2, 20215 years agoHackingUnknown
SolarWinds attackers view Microsoft source code repositoriesDec 31, 20205 years agoSupply chainUnknown
History of this record
  • 2026-09-25 · added · seed source

First seen 2026-09-25 (Research). Record counts are as reported. Not legal advice.

Everything about Microsoft

New breaches by email

Wednesdays, only in weeks with newly disclosed breaches, the largest first.

Double opt-in. Unsubscribe any time.