Microsoft faces alleged data breach, exposing employee credentials and internal files

In a concerning revelation, cybersecurity researchers Can Yoleri, Murat Özfidan, and Egemen Koçhisarlı from SOCRadar have purportedly uncovered a significant data breach within Microsoft’s infrastructure. The breach reportedly exposed employees’ credentials and internal company files to the internet. The researchers discovered an unprotected storage server hosted on Microsoft’s Azure cloud service, housing sensitive information pertaining to Microsoft’s Bing search engine.

The exposed data allegedly included code, scripts, and configuration files containing passwords, keys, and credentials utilized by Microsoft employees to access internal databases and systems. What’s alarming is that this server lacked basic password protection, potentially granting unrestricted access to anyone on the internet.

Although TechCrunch reported the breach as resolved, the implications of the exposed data remain troubling. Malicious actors could have exploited this breach to gain unauthorized access to other internal Microsoft files, posing significant security risks. Yoleri emphasized the gravity of the situation, stating that identifying storage locations of internal files "could result in more significant data leaks and possibly compromise the services in use."

Reportedly, the researchers alerted Microsoft about the breach in February, yet it took nearly a month for the company to address the issue. However, it remains unclear whether any unauthorized parties accessed the data or the duration of exposure before remedial actions were taken. Microsoft has not issued an official statement regarding the alleged security lapse, leaving many questions unanswered.