The US Cybersecurity and Infrastructure Security Agency has confirmed that Russian-based hackers used stolen Microsoft accounts to gain access to Federal emails.
In an updated statement on Thursday, CISA noted that cybercrime group calling themselves "Midnight Blizzard" infiltrated correspondence between the Federal Civilian Executive Branch and Microsoft through its customer systems.
As of writing, CISA and Microsoft have not yet detected any of the hackers trying to use the stolen government credentials to breach into active Federal computers.
CISA labeled the incident as an "unacceptable risk" to the agencies amid reports of Russia's supposed surveillance of the US government and its citizens.
Russian Hackers Reportedly in Control of Microsoft Source Code
The data breach on government agencies stemmed from a cyberattack on Microsoft last March, resulting in several leadership emails being illegally accessed.
Microsoft previously warned that the hackers were able to gain access to the company's source code and internal systems, although no customer breaches have yet been reported. That is until now.
It is worth noting that the company also provides its services, particularly Microsoft Azure, to multiple major businesses and private users in the US and around the world.
The report came after CISA earlier alerted the public that "Midnight Blizzard" is attempting to gain email accounts of several "affected agencies" through email correspondences.
Also Read : Microsoft Scrutinized Over 'Inadequate' Security Practices in the US, Calls for 'Overhaul'
Microsoft Under Scrutiny for 'Inadequate' Security Measures
Reports of Microsoft compromising sensitive government details came at a time when the company is under hot waters for
The Department of Homeland Security, in partnership with CISA, earlier reported of Microsoft failing to provide adequate guardrails to protect its state-linked emails from cyberattacks as evidenced with an earlier breach in Summer 2023.
The department's Cyber Safety Review Board deemed that the previous incidents were "preventable" and were rather a result of "a corporate culture that deprioritized enterprise security investments and rigorous risk management."
The tech giant has also reported that several cybercrime groups, many of which are based in Russia, are already using its chatbots to automate their operations.
In response, Congress suspended its access to several Microsoft digital products, including Copilot AI.
