Breachesby GlyphMicrosoft
10 breachesTechmicrosoft.com
Hijacked Microsoft GitHub repos pushed password stealers to AI coding tool usersSupply chain exposed credentials and tokens and passwords.Supply chainTechUSUnverifiedJun 8Microsoft 365 Copilot Chat bug processed confidential-labeled emails for weeksAI or model exposed messages.AI or modelTechUSUnverifiedFeb 18Storm-2139 used stolen customer credentials to hijack Azure OpenAI accountsCredential stuffing exposed source code, API keys, credentials and tokens and internal documents.Credential stuffingTechUSFeb 26, 2025Russian state hackers access Microsoft senior leadership email accountsHacking exposed emails, messages, internal documents and source code. Reported to the SEC 8-K.HackingTechUSJan 19, 2024AI research team's overly permissive SAS token exposed 38TB of internal dataExposed data exposed credentials and tokens, internal documents, messages and passwords.Exposed dataTechUSUnverifiedSep 18, 2023China-based Storm-0558 forges tokens with stolen Microsoft key to read government emailHacking exposed emails and messages.HackingTechUSJul 11, 2023Misconfigured Microsoft storage exposes prospective customer business dataExposed data exposed names, emails, phone numbers and internal documents.Exposed dataTechUSUnverifiedOct 19, 2022Lapsus$ compromises a Microsoft account and leaks Bing and Cortana source codeHacking exposed source code.HackingTechUSMar 22, 2022Hafnium exploits Exchange Server zero-days to breach on-premises mail serversHacking exposed emails, credentials and tokens and messages.HackingTechUSMar 2, 2021SolarWinds attackers view Microsoft source code repositoriesSupply chain exposed source code.Supply chainTechUSDec 31, 2020
About
Every breach here links to its sources and official notices. Across Glyph: lawsuits, incidents and outages, the company profile.
Microsoft, 2025-02-26company
Microsoft, 2025-02-26https://blogs.microsoft.com/on-the-issues/2025/02/27/disrupting-cybercrime-abusing-gen-ai/
Microsoft, 2025-02-26confirmed
Microsoft, 2025-02-26research
Microsoft, 2025-02-261
Microsoft, 2025-02-26Microsoft civil lawsuit against Storm-2139 defendants (2024-2025)
Microsoft, 2025-02-26credential-stuffing
Microsoft, 2025-02-26Microsoft said the Storm-2139 network used customer credentials scraped from public sources to access accounts on generative AI services including Azure OpenAI, altered their capabilities to bypass safeguards and resold access for creating
Microsoft, 2025-02-26Storm-2139 used stolen customer credentials to hijack Azure OpenAI accounts
Microsoft, 2023-09-18
Microsoft, 2025-02-26tech
Microsoft, 2025-02-26["source-code","api-keys","credentials","internal-docs"]
Microsoft, 2025-02-26Lasso found that once-public GitHub repositories, including ones from large companies and Microsoft, remained retrievable through Microsoft Copilot after being set private because Bing had indexed and cached them.
Microsoft, 2025-02-26Copilot surfaced thousands of GitHub repos after they were made private
Microsoft, 2026-02-18
Microsoft, 2026-06-08
Microsoft, 2020-12-31
Microsoft, 2021-03-02
Microsoft, 2022-03-22
Microsoft, 2022-10-19
Microsoft, 2023-07-11
Microsoft, 2024-01-19hacking
Microsoft, 2024-01-19["emails","messages","internal-docs","source-code"]
Microsoft, 2024-01-192024-01-12
Microsoft, 2024-01-19Microsoft detected on January 12, 2024 that the Russia-linked group Midnight Blizzard had accessed and exfiltrated data from a small percentage of corporate email accounts, including senior leadership, since late November 2023. In a March 2
Microsoft, 2024-01-19Russian state hackers access Microsoft senior leadership email accounts
Microsoft, 2025-02-26
Microsoft, 2024-01-19