Microsoft Says Password Spray on a Legacy Test Account Reached Leadership Email

On 12 January 2024 Microsoft detected that a nation-state actor had been inside its corporate systems since late November 2023 and had taken email from a small number of accounts — among them members of the senior leadership team and staff in the security and legal functions. It filed a Form 8-K under Item 1.05 seven days later and attached its own account of the incident as an exhibit.

This desk retrieved both from EDGAR. The exhibit is unusually specific about the route in, and the sentence is worth reading exactly as filed.

It is the inverse of a brute force. Rather than trying thousands of passwords against one account — which locks the account and raises an alarm — the attacker tries one common password against thousands of accounts, slowly. No individual account sees enough failures to trip a lockout, and in a large directory somebody is always using the weak password.

It requires no vulnerability, and Microsoft says so plainly: "The attack was not the result of a vulnerability in Microsoft products or services." Nothing was exploited. An account existed, it had a guessable password, and it had no second factor.

A legacy non-production test tenant is the kind of thing that exists in every organisation of any size. Somebody stood it up to try something, it served its purpose, and it was never decommissioned because decommissioning is nobody’s objective.

It sat outside whatever policy required multi-factor authentication on the accounts that mattered, because it was not an account that mattered. That judgement was correct about the account and wrong about its permissions, which is the entire incident in one line.

The corpus has filed variants of this repeatedly — access never revoked, a dormant integration, a token that outlived its purpose. What is unusual here is that the affected organisation described the mechanism itself, in a document it filed with a securities regulator.

Because password spray appears in no other file in this database, and it is not because it is rare. It is because almost nobody says how they were broken into.

That is roughly six weeks between the foothold and the detection, at the company that sells the identity platform most of the organisations in this corpus depend on. The desk records that without relish: the disclosure is more candid than most, and candour is what makes the file possible.

The Item 1.05 states that "the incident has not had a material impact on the Company’s operations" and that the company had not yet determined whether it was reasonably likely to affect financial condition or results.

Both things are true at once, and the corpus has recorded the same shape at 24-0821: materiality is indexed to the registrant, so an intrusion into the email of a company’s own senior leadership can be immaterial to a company of sufficient size. The rule measures the balance sheet, not the incident.