Microsoft — Data Breach

Executive Summary

Microsoft disclosed that a China-based threat actor, Storm-0558, used forged authentication tokens to breach email accounts at approximately 25 organizations including the US State Department and Commerce Department starting in May 2023. The attackers exploited a stolen Microsoft account signing key to forge tokens for Outlook Web Access. A DHS review later found a 'cascade of errors' in Microsoft's security practices that enabled the breach.