Russia stole Feds’ emails thanks to Microsoft’s security breach

TLDR:

• Russian spies gained access to Microsoft’s email system and stole sensitive data
• CISA issued an Emergency Directive requiring federal agencies to reset credentials

In a recent breach, Russian spies gained access to Microsoft’s email system, allowing them to steal sensitive data, including authentication details. The US government’s Cybersecurity and Infrastructure Security Agency (CISA) issued an Emergency Directive, instructing affected federal agencies to reset compromised credentials and take additional steps to secure authentication tools for privileged Microsoft Azure accounts. CISA instructed agencies to provide status updates on their remediation actions until completion.

Microsoft has notified all federal agencies whose email correspondence was identified as exfiltrated by the Russian spies, known as Midnight Blizzard or Cozy Bear. The attackers have increased the volume of intrusion attempts, such as password spraying attacks, by up to tenfold compared to previous months. This breach has raised concerns about Microsoft’s security practices and disclosure approach.

CISA aims to provide a report by September 1 detailing the cross-agency status and outstanding issues related to the breach. This incident highlights the ongoing threats posed by state-sponsored operatives and the need for robust cybersecurity measures to protect sensitive government data.