Microsoft’s breach notification emails end up in spam folder
Microsoft’s attempt to inform customers of Russian hackers going through their emails resulted in delivery into a spam folder.
Rafael Henrique via Getty Images
Microsoft’s attempt to inform customers of Russian hackers going through their emails resulted in delivery into a spam folder.
The Russian nation-state hacker group Midnight Blizzard penetrated Microsoft’s defenses last year, accessing the emails of multiple of the company’s customers. In late June, Microsoft said that more organizations were impacted than previously thought.
However, the company’s attempts to inform users might not have reached their intended recipients. According to Kevin Beaumont, a cybersecurity researcher and former senior threat intelligence analyst at Microsoft, the company opted to inform affected victims via email.
Check whether your online credentials have been compromised with an up-to-date personal data leak checker tool.
Check if your data has been compromised“The notifications aren’t in the portal – they emailed tenant admins instead. The emails can go into spam, and tenant admin accounts are supposed to be secure breakglass accounts without email. They also haven’t informed orgs via account managers,” Beaumont said on LinkedIn.
More from Cybernews
Sainsbury’s installs more facial rec tech in stores: Should shoppers be worried?
"Phantom squatting” uses AI hallucinated domains for cyber attacks
What they’re doing to gamers is a robbery in broad daylight
Irish parliament expands Microsoft use, despite the EU’s efforts to ditch it
Can government AI actually scrub UAP footage from the internet?
The EU and Apple CEO Tim Cook held "constructive" talks after their Siri AI dispute in Europe
We reached out to Microsoft for comment but have yet to receive a reply.
Others joined in on Beaumont’s post, claiming that numerous organizations took Microsoft’s email as a phishing attempt and either deleted the email or marked it as spam. The breach notification emails supposedly lacked basic email authentication methods such as SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail).
“Well, at first glance, this did not inspire trust for the recipients, who started asking in forums or reaching out to Microsoft account managers to eventually confirm that the email was legitimate...weird way for a provider like this to communicate an important issue to potentially affected customers,” the Greece-based cybersecurity consultant said.
Microsoft confirmed in January that Midnight Blizzard was detected trying to infiltrate the tech giant’s corporate systems. The same hacker group was responsible for the infamous SolarWinds hack that wreaked havoc on US government installations in 2020.