Microsoft Faces New Security Lapse as Internal Data is Exposed on Azure

A week after US federal agencies criticized Microsoft for its security practices, a new issue has surfaced involving unprotected internal data on an Azure cloud server.

Cybersecurity firm SOCRadar informed TechCrunch that in February, they accessed data related to Microsoft’s Bing search engine, along with other sensitive files containing passwords, credentials, code, and scripts crucial to company operations, all because the data wasn’t password protected.

It reportedly took Microsoft about a month to secure the data after being alerted by SOCRadar, raising concerns about how long the information was exposed. The breach could potentially lead to significant data leaks or compromised Microsoft services if accessed by malicious parties.

This incident adds to a troubling history of security breaches at Microsoft. Previous incidents include Russian hackers infiltrating Microsoft’s corporate email to access source code repositories and a Microsoft AI employee accidentally leaking 38TB of sensitive data. Additionally, the cybercriminal group LAPSUS$ has previously leaked substantial data related to Bing, Microsoft Maps, and the now-defunct Cortana.

Following these repeated security failures, a Microsoft representative expressed the company’s intent to “adopt a new culture” around security. This statement came after a board created by the US Cybersecurity and Infrastructure Security Agency called for fundamental changes in Microsoft’s security practices. The spokesperson added, “Our security engineers continue to harden all our systems against the attack and implement even more robust sensors and logs to help us detect and repel the cyber-armies of our adversaries.”