Microsoft denies data breach, theft of 30 million customer accounts

[P4-630]

Microsoft has denied the claims of the so-called hacktivists “Anonymous Sudan” that they breached the company's servers and stole credentials for 30 million customer accounts.

Anonymous Sudan is known for debilitating distributed denial-of-service (DDoS) attacks against Western entities in recent months. The group has confirmed their affiliation with pro-Russian hacktivists like Killnet.

Last month, Microsoft admitted that Anonymous Sudan was responsible for service disruptions and outages at the beginning of June that impacting several of its services, including Azure, Outlook, and OneDrive.

Yesterday, the hacktivists alleged that they had “successfully hacked Microsoft” and “accessed a large database containing more than 30 million Microsoft accounts, emails, and passwords.”

Anonymous Sudan offered to sell this database to interested parties for $50,000 and urged interested buyers to engage in contact with their Telegram bot to arrange the purchase of the data.


More:

Microsoft denies data breach, theft of 30 million customer accounts

Microsoft has denied the claims of the so-called hacktivists "Anonymous Sudan" that they breached the company's servers and stole credentials for 30 million customer accounts.

www.bleepingcomputer.com

 

[eidairaman1]

Microsoft has denied the claims of the so-called hacktivists “Anonymous Sudan” that they breached the company's servers and stole credentials for 30 million customer accounts.

Anonymous Sudan is known for debilitating distributed denial-of-service (DDoS) attacks against Western entities in recent months. The group has confirmed their affiliation with pro-Russian hacktivists like Killnet.

Last month, Microsoft admitted that Anonymous Sudan was responsible for service disruptions and outages at the beginning of June that impacting several of its services, including Azure, Outlook, and OneDrive.

Yesterday, the hacktivists alleged that they had “successfully hacked Microsoft” and “accessed a large database containing more than 30 million Microsoft accounts, emails, and passwords.”

Anonymous Sudan offered to sell this database to interested parties for $50,000 and urged interested buyers to engage in contact with their Telegram bot to arrange the purchase of the data.


More:

Microsoft denies data breach, theft of 30 million customer accounts

Microsoft has denied the claims of the so-called hacktivists "Anonymous Sudan" that they breached the company's servers and stole credentials for 30 million customer accounts.

www.bleepingcomputer.com

And ms wants us to have ms accounts and not local profiles on PCs, MS can pound sand.

 

[P4-630]

I'm using Local accounts on all my systems and keep doing that.

 

[Bones]

Same here - No MS account, OneDrive or crap concerning "The Cloud" or anything else that isn't localized.

 

[eidairaman1]

Same here - No MS account, OneDrive or crap concerning "The Cloud" or anything else that isn't localized.

When the term cloud first came along I just said I don't trust it at all and this proves the point with data breaches having happened to Gigabyte and MSI recently too.

 

[A Computer Guy]

When the term cloud first came along I just said I don't trust it at all and this proves the point with data breaches having happened to Gigabyte and MSI recently too.

Also what happens when these big companies hoarding cloud data goes under or stops services?

I experimented with google music purchases for awhile and was lucky enough to get copies of my google music purchases sometime after they shut it down. By sheer luck it wasn't completely gone by the time I realised what happened after I reset my Android Phone.

 

[eidairaman1]

Exactly

 

[LabRat 891]

I find it 'funny' that everyone bringing up concerns over 'cloud'-anything were (and still are) called paranoid or conspiracy-theorists.
Seems like only the 'crazy sounding' were paraded around out in front, and those with legitimate security concerns from bad actors (read: criminals), were largely ignored.

IMO, "Privacy" doesn't exist as a concept for keeping naughty secrets, but rather to minimize the 'attack surface' on an individual's property and data.

 

[Ociya Syndor]

Also what happens when these big companies hoarding cloud data goes under?

grats on your 1,337'th post

personally, i'm waiting to go under, so i can get caught up into the 'cloud'

 

[eidairaman1]

I find it 'funny' that everyone bringing up concerns over 'cloud'-anything were (and still are) called paranoid or conspiracy-theorists.
Seems like only the 'crazy sounding' were paraded around out in front, and those with legitimate security concerns from bad actors (read: criminals), were largely ignored.

IMO, "Privacy" doesn't exist as a concept for keeping naughty secrets, but rather to minimize the 'attack surface' on an individual's property and data.

Actors to me is a wrong term to use for criminals, terrorists, tyrannical governments.
Its like using a term to not be offensive to them.

 

[LabRat 891]

Actors to me is a wrong term to use for criminals, terrorists, tyrannical governments.

Not incorrect: It's inaccurately-reductionist and minimizing of the implicit (and interconnected) consequences.

"Bad Actor(s)" is also an acceptable term 'to all sides' (ie. it's PC)

 

[Bill_Bright]

FTR, I believe Microsoft when they say user account information was not stolen. It would serve no one, especially Microsoft, to lie about that. The truth always comes out in the end and for sure, the cover up is typically much more serious, and damaging for the company, than the actual crime. And Microsoft knows that very well.

They already admitted their servers were attacked and serious DDoS disruptions and outages happened. That was bad and a black eye for MS.

But, as to Anonymous Sudan claiming they have stolen 30 million users' data, note according to TechRadar,

The data sample, according to BleepingComputer, includes 100 credential pairs. However, the origin of the credentials cannot be verified. They could be from a different data breach, they could be old, or taken from a third-party, rather than Microsoft itself.

So where's the irrefutable evidence? As of now, it is not there.

I AM NOT DEFENDING MICROSOFT. I am just trying to learn and verify the facts - ALL the facts - before passing judgement. And I am waiting to see what else, if anything, we may learn about this so-called theft.

There are all sorts of levels to system hacks, breaches and attacks. There is no denying Microsoft has been attacked, and those attacks were very effective at causing disruptions. But there is, at least at this point in time, no evidence any personal data was accessed, or more importantly copied/stolen during these attacks.

To steal data from a computer, it has to be copied. And that process (including timestamps) is recorded in logs. Thus, not hard to verify.

THAT SAID, while I have, on many occasions defended Microsoft when falsely accused, I have never, do not, nor will I ever fully trust them, or any company, completely.

For that reason, I also have local accounts on all my computers here, and have no desire to ever use Microsoft accounts on any of my systems.