250 Million Microsoft Customer Support Records Exposed Online

If you've got ever contacted Microsoft for help inside the past 14 years, your technical query, alongside some individually identifiable records might have been compromised.

In a blog post, Microsoft confirmed that due to misconfigured safety rules brought to the server in the query on December 5, 2019, enabled exposure of the statistics, which remained the equal until engineers remediated the configuration on December 31, 2019.

Microsoft also stated that the database becomes redacted the usage of automated equipment to get rid of the personally identifiable facts of most clients, besides in some eventualities in which the information turned into now not the standard format.

However, in keeping with Diachenko, many facts in the leaked database contained readable information on customers, together with their:

email addresses
IP addresses
Locations
Descriptions of CSS claims and cases
Microsoft assist agent emails
Case numbers, resolutions, and remarks
Internal notes marked as "confidential."

By having actual touchy case statistics and e-mail addresses of affected clients in hand, the leaked information may be abused using tech-guide scammers to trick users into buying non-existent computer problems by way of impersonating

The statistics are a gold mine for affected person criminals aiming to breach large businesses and governments," COO of ImmuniWeb Ekaterina Khrustaleva instructed The Hacker News.

There is more than one layer of controls and schooling designed to stop it from going on. And it suggests you how hard it's miles to prevent it 100% of the time. Nothing is perfect. Mistakes and leaks happen. Every employer has overly permissive permissions. Every! It's only a be counted of if someone out of doors the organization discovers it or if a person takes benefit of it."

Sure, the records, sitting unprotected, may want to have also been used by the horrific guys, however so far, no person has made that case or provided evidence that it has been used maliciously," Grimes delivered.

"Anyone can have a mistake. The most vital question is how the mistake passed off and the way to save you it from happening next time, and if any others ought to have happened from the same set of circumstances."

As a result of this incident, the agency said it commenced notifying impacted customers whose facts changed into the present in the uncovered Customer Service and Support database.

Source: The Hacker News