Sunday, May 19, 2024

Microsoft Data Leak – 2.4TB of 65,000+ Companies Data Leaked Online

Recently, Microsoft has confirmed that due to a misconfiguration of Microsoft server multiple sensitive information about some of Microsoft’s customers was exposed over the internet.

A total of over 65,000 leaked entities were detected by SOCRadar in this leak, which has now become public.

Security researchers from SOCRadar, a company that specializes in threat intelligence, alerted Microsoft on September 24, 2022, that there had been a leak on the server. However, after getting notified, Microsoft immediately secured the leaked server.

Data leak

A list of the exposed information is provided by Microsoft and includes the following information:-

  • Names
  • Email addresses
  • Email content
  • Company name
  • Phone numbers
  • Business files

On the endpoint where the leak was discovered, a misconfiguration was unintentionally made, which led to the leak. The leak has not occurred as a result of a security vulnerability, so it cannot be blamed on that.

The cybersecurity analysts have identified information for more than 150,000 companies from 123 countries in six large public buckets.

In order to better track the intelligence around these leaks, SOCRadar researchers have named these leaks “BlueBleed”. There was no further detail provided by Microsoft about this data leak, as they abstained from sharing any additional information.

With the help of exposed information, threat actors could perform the following illicit activities to take advantage of that information:-

  • Extortion
  • Blackmail
  • Social engineering

While this was revealed by SOCRadar’s report, which showed the data was found to be stored on a misconfigured Azure Blob Storage area.

It has been determined that there are more than 65,000 entities associated with the cluster of leaked sensitive data from 111 different countries. There were files that contained all these leaked data, and all of them were dated from 2017 to August 2022.

A SOCRadar investigation has resulted in the discovery of 2.4 TB of publicly available information containing sensitive Microsoft information as a result of:-

  • Misconfigured server
  • SQLServer databases
  • Other files

Furthermore, there has been a great deal of data discovered from leaks so far, including:-

  • Over 335,000 emails
  • Over 133,000 projects
  • Over 548,000 exposed users

Exposed Files

The misconfigured buckets have exposed a variety of files, such as the following:-

  • POE documents
  • SOW documents 
  • Invoices
  • Product orders
  • Product offers
  • Project details
  • Signed customer documents
  • POC (Proof of Concept) works
  • Customer emails (as well as .EML files)
  • Customer product price list and customer stocks
  • Internal comments for customers (High risk etc.)
  • Sales strategies
  • Customer asset documents
  • Partner ecosystem details

Recommendations

Here below, we have mentioned all the recommendations:-

  • Control and manage external-facing endpoints by mapping out your attack surface. 
  • Consider applying a shared responsibility model in your organization.
  • Make your environments more secure and manageable with identity and access solutions.
  • It is recommended that you use a shared access signature token.
  • Make sure that your data is encrypted when it is not in use.
  • Establish and enforce cloud security policies based on a zero-trust approach.
  • Prevent data breaches by securing your endpoints
  • Make sure your attack surface is monitored for external assets that are open to the public.

Managed DDoS Attack Protection for Applications – Download Free Guide

Website

Latest articles

Norway Recommends Replacing SSLVPN/WebVPN to Stop Cyber Attacks

A very important message from the Norwegian National Cyber Security Centre (NCSC) says that...

New Linux Backdoor Attacking Linux Users Via Installation Packages

Linux is widely used in numerous servers, cloud infrastructure, and Internet of Things devices,...

ViperSoftX Malware Uses Deep Learning Model To Execute Commands

ViperSoftX malware, known for stealing cryptocurrency information, now leverages Tesseract, an open-source OCR engine,...

Santander Data Breach: Hackers Accessed Company Database

Santander has confirmed that there was a major data breach that affected its workers...

U.S. Govt Announces Rewards up to $5 Million for North Korean IT Workers

The U.S. government has offered a prize of up to $5 million for information...

Russian APT Hackers Attacking Critical Infrastructure

Russia leverages a mix of state-backed Advanced Persistent Threat (APT) groups and financially motivated...

Millions Of IoT Devices Vulnerable To Attacks Leads To Full Takeover

Researchers discovered four significant vulnerabilities in the ThroughTek Kalay Platform, which powers 100 million...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles