14 DAY TRIAL // Microsoft claims that an attacker gained access to one of its customer service representatives and used the information for targeted hacking. The organization said it has notified affected consumers, according to a blog post on the company's website.
The company said on Friday that they found the vulnerability while responding to a recent wave of cyberattacks they described as significant from an older acquaintance, NOBELIUM.
Customers who had been compromised were advised to exercise additional caution when interacting with their billing contacts and change their usernames and email addresses. Users were urged not to use out-of-date usernames in order to reduce the number of logins..
Despite the numerous attempts, just three businesses were successfully phished, revealing that the vast majority of the targeted companies were not affected. Microsoft was unable to clarify by now whether the agent was a contractor or an employee of the company.
Countries and sectors that been impacted by the attack
About 45% of the hacking activity was concentrated in the US, with about 10% in the UK, Germany, and Canada. Microsoft disclosed that 36 countries were affected. To prevent attacks, Microsoft recommends that everyone take various measures, such as enabling multi-factor authentication on their devices.
This activity was primarily aimed at IT sector clients, counting approximately 57% of known attacks. Nonetheless, the other sectors including government, smaller numbers of non-governmental organizations, think tanks, and financial services companies, were not spared either.
Although the inquiry is still continuing, Microsoft claims that its support agents are set up with the very minimum set of permissions necessary as part of its Zero Trust least privileged access approach to customer information.
Microsoft explains further that this exercise emphasizes the significance of best practice security measures such as zero-trust architecture and multi-factor authentication, as well as the importance of these precautions for all users and organizations.