<- Back to Insights
April 5, 2024
DHS blames ‘cascade of security failures at Microsoft’ for China hack on US government
The Record
|
Contributed by: Drex DeFord
Summary
A Department of Homeland Security review, conducted by the Cyber Safety Review Board (CSRB), found that Chinese hackers, known as Storm-0558, accessed the emails of senior U.S. officials including U.S. Commerce Secretary and others, exploiting a series of security failures at Microsoft. The report, which scrutinized a 2023 incident affecting 22 organizations and 503 individuals worldwide, criticized Microsoft for a corporate culture that deprioritized security investments and risk management, leading to the breach. The hackers were able to infiltrate Microsoft systems and download approximately 60,000 emails from the State Department by exploiting operational flaws and obtaining a critical signing key, the origin of which Microsoft has yet to identify. The CSRB report, which also linked the hackers to previous significant cyber incidents, emphasized the need for Microsoft to overhaul its security culture and implement the recommended security improvements urgently to protect against nation-state threats.
![]()
Explore Related Topics
