Skip to content
Breach Index · running record

Microsoft data breaches (2022–2024): Storm-0558, Midnight Blizzard and what customers should do

Microsoft runs Sentinel and Defender, and the identity and email platforms most organisations log into every day. Two nation-state intrusions in 2023 and 2024 reached Microsoft’s own keys, mailboxes and source code, and drew a US Cyber Safety Review Board report and a CISA emergency directive. This is the record of what Microsoft confirmed, what the government found, and what is still unknown.

Short answer

Was Microsoft hacked?

Yes. In July 2023 Microsoft said a China-based actor it calls Storm-0558 used an acquired Microsoft account (MSA) consumer signing key to forge tokens and read email at about 25 organisations, including government agencies, from 15 May 2023. The US Cyber Safety Review Board later counted 22 organisations and 503 people, called the intrusion preventable and blamed “a cascade of security failures at Microsoft”.

In January 2024 Microsoft disclosed that Russia’s Midnight Blizzard had password-sprayed a legacy test tenant and read a “very small percentage” of corporate mailboxes, including senior leadership. In March 2024 it said the actor had used stolen email to reach some source code repositories and internal systems, and that some secrets customers had emailed to Microsoft were exposed. CISA ordered federal agencies to analyse their stolen correspondence and reset credentials (ED 24-02).

Timeline at a glance

  1. 22 Mar 2022Lapsus$ compromises one Microsoft account; Microsoft says access was limited and no customer code or data was involved. (BleepingComputer)Confirmed
  2. 11 Jul 2023Microsoft discloses Storm-0558 forged tokens to read email at about 25 organisations. (Microsoft)Confirmed
  3. Sep 2023AI research team’s over-permissive storage token exposed 38TB of internal data (found by Wiz). (The Hacker News)Confirmed
  4. 19 Jan 2024Midnight Blizzard read corporate mailboxes, including senior leadership. (MSRC)Confirmed
  5. 8 Mar 2024Microsoft says the actor reached source code repositories and internal systems. (BleepingComputer)Confirmed
  6. 2 Apr 2024CSRB report on Storm-0558 published; CISA issues ED 24-02 on Midnight Blizzard. (CISA / CSRB)Confirmed

Last updated 1 November 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.

Microsoft incident timeline, in detail

Confirmed = acknowledged by Microsoft, a regulator filing or a court. Reported = credible reporting Microsoft has not fully confirmed. Unverified claim = an attacker or leak-site claim.

May – Jul 2023ConfirmedNation-state intrusion / signing-key theft

Storm-0558 forges authentication tokens and reads Exchange Online and Outlook.com mail

What happened. Microsoft said on 11 July 2023 that a China-based actor it tracks as Storm-0558 had, from 15 May 2023, used forged authentication tokens built with an acquired MSA consumer signing key to access user email at approximately 25 organisations, including government agencies, plus related consumer accounts. Microsoft began investigating on 16 June 2023 based on customer-reported information.

Impact. The Cyber Safety Review Board, reporting in April 2024, said the actor reached the Exchange Online mailboxes of 22 organisations and 503 people, that Microsoft relied on a notification from the US State Department rather than detecting it, and that Microsoft still could not show the Board how the 2016 key was obtained. The Board called the intrusion preventable and Microsoft’s security culture inadequate.

Sources: Microsoft, 11 Jul 2023 · CSRB report (PDF) · The Record

Jan – Mar 2024ConfirmedNation-state intrusion / password spray

Midnight Blizzard reads executive email, then reaches source code and internal systems

What happened. Microsoft said it detected the attack on 12 January 2024. The actor used a password spray to compromise a legacy non-production test tenant account, then used that account’s permissions to access “a very small percentage” of Microsoft corporate email accounts, including senior leadership and staff in cybersecurity and legal roles, and exfiltrated some emails and attachments. Microsoft disclosed it in an SEC 8-K and a blog post on 19 January 2024.

Impact. On 8 March 2024 Microsoft said the actor had used information from the stolen email to access some of its source code repositories and internal systems, that some secrets shared between customers and Microsoft by email were exposed (it said it was contacting those customers), and that password-spray volume rose as much as tenfold in February. Microsoft said it had found no evidence that Microsoft-hosted customer-facing systems were compromised.

Sources: MSRC, 19 Jan 2024 · BleepingComputer, 8 Mar 2024

2 Apr 2024ConfirmedGovernment response

CISA Emergency Directive 24-02: federal email to Microsoft was stolen

What happened. CISA said Midnight Blizzard had exfiltrated email correspondence between federal civilian agencies and Microsoft, and was using authentication details from it to try to access Microsoft customer systems. Agencies had to remediate exposed tokens, passwords and API keys, and by 30 April 2024 reset credentials, review sign-in and token logs, and analyse the content of their correspondence with compromised Microsoft accounts.

Impact. CISA said other organisations may also have been affected and should contact their Microsoft account team. CISA sunset the directive on 8 January 2026.

Sources: CISA ED 24-02

Mar 2022ConfirmedExtortion group / account compromise

Lapsus$ compromises a single Microsoft account and leaks source code

What happened. After Lapsus$ released about 37GB of material it said came from Microsoft’s Azure DevOps server, including code for Bing, Cortana and Bing Maps, Microsoft said “a single account had been compromised, granting limited access”.

Impact. Microsoft said no customer code or data was involved.

Sources: BleepingComputer, 22 Mar 2022

Jun – Sep 2023ConfirmedCloud misconfiguration / exposure

AI research storage token exposed 38TB of internal data

What happened. Wiz found that a Microsoft AI research GitHub repository shared an Azure storage link (SAS token) that gave access to an entire storage account, about 38TB, including secrets, private keys, passwords and over 30,000 internal Teams messages, per Wiz. Microsoft revoked the token on 24 June 2023 and disclosed it on 18 September 2023.

Impact. Microsoft said its investigation found no evidence of unauthorised exposure of customer data. This was an exposure, not a confirmed theft.

Sources: The Hacker News, Sep 2023

Where the reports disagree

  • How many victims of Storm-0558? Microsoft said “approximately 25 organisations” in July 2023; the CSRB counted 22 organisations and 503 individuals.
  • How was the Storm-0558 key stolen? Microsoft’s September 2023 crash-dump explanation was a theory; the CSRB said Microsoft still could not show how the key was obtained and, per The Record, pressed Microsoft to say publicly that the theory was unproven.
  • Midnight Blizzard source code: Microsoft confirmed access to “some” repositories but has not said publicly which products or how much.

The pattern across the record

Identity is the blast radius

Both big intrusions ran through identity: a signing key that could mint tokens for any mailbox, and a forgotten test tenant without MFA whose app permissions reached corporate email. For a vendor whose products are also your identity provider and SIEM, its key and tenant hygiene is your exposure.

Secrets in support email

Midnight Blizzard turned customers’ emailed credentials into a second-stage attack. Anything you have sent a vendor by email, including tokens, keys and passwords, should be treated as stored in that vendor’s mailbox.

What it means for Microsoft customers — and what to do

If you use Microsoft Sentinel, Defender, Entra ID or Exchange Online, these incidents are about Microsoft’s identity and email estate, not your tenant. The risk to you is what you shared with Microsoft and how your own tenant trusts Microsoft-issued tokens.

  1. 1.Rotate any secret you ever emailed to Microsoft

    API keys, connector secrets, service-account passwords or certificates sent to Microsoft support or account teams by email should be assumed exposed. Rotate them, and verify the new secret works before revoking the old one.

    Leaked credential response
  2. 2.Review app registrations and OAuth grants in your tenant

    Midnight Blizzard’s path was an old test tenant and an over-privileged OAuth app. Find dormant tenants, apps with mail or directory permissions, and any without MFA on their owners.

    OAuth consent lab
  3. 3.Keep the logs that caught Storm-0558

    Per the CSRB, a customer (the State Department), not Microsoft, first spotted Storm-0558. Make sure audit logging for mailbox access and token sign-ins is on, retained and flowing into your SIEM.

    Cloud logging gap checker
  4. 4.Protect the SIEM data path

    Review which Microsoft identities and service principals can read or change your Sentinel workspace and log analytics data, and alert on new role assignments.

  5. 5.Ask your account team

    CISA advised organisations that corresponded with Microsoft to ask their Microsoft account team whether their email was among what was taken.

CISO takeaways

Score your security vendors too

Ask about signing-key protection, test-tenant hygiene and how they detect access to their own executives’ mail.

Vendor Risk Scorecard
Practise an identity compromise

Work through token theft and mailbox access the way Storm-0558 played out.

Identity compromise checklist
Brief the board on nation-state risk

Turn the CSRB findings into decisions your executives can act on.

Nation-State Brief Lab
Rotate in the right order

Plan which secrets to rotate first so nothing breaks mid-change.

Secret rotation order planner

Sources

Company statements and regulator filings first, then reputable reporting. Reviewed 1 November 2026.

  1. 1.Mitigation for China-based threat actor activity — Microsoft, 11 Jul 2023
  2. 2.Review of the Summer 2023 Microsoft Exchange Online Intrusion — Cyber Safety Review Board (CISA), Apr 2024
  3. 3.CSRB releases report on Microsoft Online Exchange incident — CISA, 2 Apr 2024
  4. 4.Microsoft actions following attack by nation-state actor Midnight Blizzard — Microsoft (MSRC), 19 Jan 2024
  5. 5.ED 24-02: Mitigating the significant risk from nation-state compromise of Microsoft corporate email — CISA, 2 Apr 2024
  6. 6.DHS blames “cascade of security failures” at Microsoft — The Record, Apr 2024
  7. 7.Microsoft says Russian hackers breached its systems, accessed source code — BleepingComputer, 8 Mar 2024
  8. 8.Microsoft confirms they were hacked by Lapsus$ — BleepingComputer, 22 Mar 2022
  9. 9.Microsoft AI researchers accidentally expose 38TB of data — The Hacker News, Sep 2023

Frequently asked questions

Was Microsoft hacked?

Yes. Microsoft confirmed that China-linked Storm-0558 forged tokens to read email at about 25 organisations in 2023, and that Russia’s Midnight Blizzard read some corporate mailboxes, including senior leadership, and later reached some source code repositories in 2024.

What was the Storm-0558 Microsoft hack?

From 15 May 2023 a China-based actor used an acquired Microsoft consumer signing key to forge tokens and read Exchange Online and Outlook.com email. The Cyber Safety Review Board counted 22 organisations and 503 people affected and called it preventable.

What did Midnight Blizzard take from Microsoft?

Emails and attachments from a very small percentage of corporate mailboxes, including senior leaders, and, according to Microsoft in March 2024, access to some source code repositories and internal systems. Some secrets customers had emailed to Microsoft were in the stolen mail.

Was customer data in Microsoft’s cloud accessed?

In Storm-0558, yes: customer mailboxes were read using forged tokens. In Midnight Blizzard, Microsoft said it found no evidence Microsoft-hosted customer-facing systems were compromised, but customer correspondence and some shared secrets were in the stolen email.

What should Microsoft Sentinel or Defender customers do?

Rotate any secret you emailed to Microsoft, review OAuth apps and dormant tenants, make sure mailbox-access and token sign-in logs are retained and in your SIEM, and restrict who can change your Sentinel workspace.

Our coverage of Microsoft

More in the Breach Index

Same sourced, verification-tagged timeline, company by company — compare how peers have fared.

Oracle data breachTechnology

Oracle Health, legacy cloud logins and the EBS zero-day.

Salesforce data breachTechnology

Vishing and stolen OAuth tokens across customer tenants.

Workday data breachTechnology

A third-party CRM, business contacts, no tenant access.

Red Hat data breachTechnology

A consulting GitLab and claimed client engagement reports.

Or see the full Breach Index and how to read it.

Independent analysis for security-leadership education; not affiliated with or endorsed by Microsoft. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.

🖤 Black Friday: new customers get 3 months of Pro for $5, then $5/month. Ends 30 Nov. Claim 3 months for $5 →