250 Million Microsoft Customer Service Records Exposed; Exactly How Bad Was It?

By Scott Ikeda for CPO Magazine
Monday, February 3, 2020

• 3.5k
• 4
• 4
• 4
• 2
• More
• 4
• 4
• 4

Microsoft does redact certain key personal information from these logs: email addresses, payment information and contract numbers. However, there is other personally identifiable information that remains behind and may have been exposed online. The Comparitech team found case numbers, details of cases, resolutions, remarks and internal notes that were marked as “confidential” in the customer service records.

According to Ekaterina Khrustaleva, COO of web security company ImmuniWeb: “Assuming the data was not exploited by malicious actors as per the official statement, there is not much practical risk so far. However, it is impossible to say whether the information from this server, or other presumably existing servers, has ever been detected and stolen by cybercriminals.

“The absence of PII in the dump is irrelevant here, given that technical support logs frequently expose VIP clients, their internal systems and network configurations, and even passwords. The data is a gold mine for patient criminals aiming to breach large organizations and governments.

“Worse, many large companies and not only Microsoft have lost visibility of their external attack surface, exposing their clients and partners to significant risks. We will likely see a multitude of similar incidents in 2020.”

The primary danger is that this information could be used in technical support scams directed at Microsoft customers. Scammers very frequently identify themselves as Microsoft support agents, cold-calling targets and trying to convince them that something is wrong with their computer. The most common variety of the scam is to try to sell the target an overpriced piece of unnecessary “virus scanning” software (and potentially steal their credit card number in the process), but the bolder scammers may attempt to get the target to grant them remote control of their computer. Scammers might also simply email targets and try to get them to visit malware links under the ruse of providing some sort of technical support. Read Full Article