Shockwaves from the Russian government’s hack of Microsoft’s corporate infrastructure continue to spread with news that the software giant is notifying surprised customers that their emails were also stolen by the Midnight Blizzard hackers.
The mega-breach, which led to a US government investigation and a massive overhaul of Microsoft’s security practices, was previously known to expose Microsoft source code and corporate emails but it appears that a larger base of the company’s customers were among the victims.
According to published reports, Redmond’s incident response team is providing a secure portal for customers to view specifics of emails stolen by the Midnight Blizzard threat actor.
“You are receiving this notification because emails were exchanged between Microsoft and accounts in your organization, and those emails were accessed by the threat actor Midnight Blizzard as part of their cyber-attack on Microsoft,” the company said.
“As part of our commitment to transparency, we are proactively sharing these emails. We have custom built a secure system to enable the approved members of your organization to review the exfiltrated emails between Microsoft and your company,” according to the notifications.
Earlier this year, Microsoft described the incident as an “ongoing attack” and warned that the Midnight Blizzard hacking group was “still attempting to use secrets of different types that were shared between customers and Microsoft in email in additional attacks.”
“[As] we discover them in our exfiltrated email, we have been and are reaching out to these customers to assist them in taking mitigating measures,” the company said at the time, noting that the hackers may be using the stolen information to accumulate a picture of areas to attack and enhance its ability to do so.”
While the full scope of the incident remains in flux, surprised customers posted screenshots of the latest Microsoft notifications on social media, confirming the hack had a broader impact on the company’s customer base.
Midnight Blizzard/Nobelium (AKA APT29 and Cozy Bear by others) is the same group that was attributed to hacking IT management solutions provider SolarWinds in a massive supply chain attack in 2020.
