Microsoft security failures let Chinese state-linked hackers read the email of senior US officials in 2023. The US Cyber Safety Review Board found the intrusion by Storm-0558 was preventable. In May and June 2023 the group reached the mailboxes of 22 organizations and over 500 people, including the Commerce Secretary and the US Ambassador to China.
How did Chinese hackers reach US officials’ email?
Over the summer of 2023, Microsoft faced criticism for security blunders that allowed Chinese hackers to peek into the emails of US government officials. A detailed report pointed out that these breaches could have been prevented if Microsoft had stronger security measures in place. The attackers managed to infiltrate the email systems of notable figures, including the US Secretary of Commerce and the Ambassador to China, by exploiting a loophole in Microsoft’s email service and using a special key.
What did the review say about Microsoft’s response?
The investigation highlighted Microsoft’s slow response to correct misleading information released after the incident and called out the tech giant for its lax security practices. It also brought up a separate breach by Russian hackers, underlining the pressing need for better security across the board.
What did the report recommend Microsoft do?
To combat these vulnerabilities, the report suggests Microsoft should beef up its security by doing more thorough checks on its systems, pausing new feature releases until security is tight, and being more transparent with the public. On top of that, it recommends creating stronger barriers against hackers. By taking these steps, the hope is to make it much tougher for hackers to break in, protecting everyone’s data from getting into the wrong hands.