Home Office confirms Russian threat actors accessed emails after Microsoft hack
The Russian hacking group Midnight Blizzard breached the UK Home Office and stole sensitive data as part of the hacking campaign revealed earlier this year.
Freedom of Information (FoI) requests from Recorded Future News indicate that the Russia-backed hacking group was able to access corporate emails and data shared with Microsoft.
The Home Office said its own systems weren’t affected, and an Information Commissioner’s Office (ICO) spokesperson told Recorded Future that it had concluded that no further action was required.
The attack formed part of a hacking campaign uncovered in January, which saw the attackers leveraging an OAuth app within Microsoft’s test tenant.
This granted the hackers elevated permissions, which they were then able to use to gain access to emails from Microsoft and its customers, including members of Microsoft’s senior leadership team and staff in its cybersecurity, legal, and other departments.
Midnight Blizzard also gained access to inboxes belonging to the US government.
Microsoft said it was able to identify the attacks in log data by reviewing Exchange Web Services (EWS) activity and using its audit logging features.
“The attack was not the result of a vulnerability in Microsoft products or services,” the company said. “To date, there is no evidence that the threat actor had any access to customer environments, production systems, source code, or AI systems. We will notify customers if any action is required.”
However, the news reinforces concerns about Microsoft’s dominance, and its own security practices.
In April, the US Department of Homeland Security’s Cyber Safety Review Board (CSRB) said Microsoft’s security culture was “inadequate and requires an overhaul” following the breach of email accounts at 22 organizations, including some government agencies.
“Governments and organizations are placing their trust in Microsoft when they store their data in its services, so security should be a guarantee. But unfortunately with Microsoft it’s not,” said Kevin Robertson, COO of Acumen Cyber.
“In this incident, it was Microsoft’s lack of internal security that caused the attack. It had no MFA deployed on a non-production test tenant account, which provided Midnight Blizzard with initial access.”
He added: “All organizations should see MFA as non-negotiable today, and the fact that Microsoft, the world’s biggest and most prominent tech firm, did not have the function enabled raises very worrying alarm bells. How can the infrastructure of the world be safely built on a company that isn’t practicing basic cyber hygiene? That’s a question that cannot be ignored.”
