250 Million Microsoft Customer Support Records Exposed Online | Ron Benvenisti

Have you ever gotten a phone call from “Microsoft Support” where the caller claims to be a MS Support Technician from Redmond, WA? He give you his American sounding name but he has a distinct foreign accent?

He asks you to perform certain actions on you PC so that he can remove “an virus infection”, but in reality he his asking you to set up remote access for him to install ransomware. Here’s the scoop….

If you have ever contacted Microsoft for support in the past 14 years, your technical query, along with some personally identifiable information might have been compromised.

Microsoft today admitted a security incident that exposed nearly 250 million “Customer Service and Support” (CSS) records on the Internet due to a misconfigured server containing logs of conversations between its support team and customers.

According to Bob Diachenko, a cybersecurity researcher who spotted the unprotected database and reported to Microsoft, the logs contained records spanning from 2005 right through to December 2019.

In a blog post, Microsoft confirmed that due to misconfigured security rules added to the server in question on December 5, 2019, enabled exposure of the data, which remained the same until engineers remediated the configuration on December 31, 2019.

Microsoft also said that the database was redacted using automated tools to remove the personally identifiable information of most customers, except in some scenarios where the information was not the “standard format”.

“Our investigation confirmed that the vast majority of records were cleared of personal information in accordance with our standard practices,” Microsoft said.

However, according to Diachenko, many records in the leaked database contained readable data on customers, including their:

  • Email addresses,
  • Name
  • Phone Number
  • IP addresses,
  • Locations,
  • Descriptions of CSS claims and cases,
  • Microsoft support agent emails,
  • Case numbers, resolutions, and remarks,
  • Internal notes marked as “confidential.”

“This issue was specific to an internal database used for support case analytics and does not represent an exposure of our commercial cloud services,” (Azure) Microsoft said.

By having real sensitive case information and email addresses of affected customers in hand, the leaked data could be abused by tech-support scammers to trick users into paying for non-existent computer problems by impersonating Microsoft support representatives.

“The absence of Personally Identifiable Information in the dump is irrelevant here, given that technical support logs frequently expose VIP clients, their internal systems and network configurations, and even passwords. The data is a gold mine for patient criminals aiming to breach large organizations and governments,” COO of ImmuniWeb Ekaterina Khrustaleva told The Hacker News.

“Worse, many large companies and not only Microsoft have lost visibility of their external attack surface, exposing their clients and partners to significant risks. We will likely see a multitude of similar incidents in 2020.”

KnowBe4’s Data-Driven Defense Evangelist Roger Grimes also shared his comment and experience with The Hacker News, saying:

“Having worked for Microsoft for 15 years, 11 years as a full-time employee, I’ve seen firsthand how much they try to fight scenarios like this. There are multiple layers of controls and education designed to stop it from happening. And it shows you how hard it is to prevent it 100% of the time. Nothing is perfect. Mistakes and leaks happen. Every organization has overly permissive permissions. Every! It’s just a matter of if someone outside the organization discovers it or if someone takes advantage of it.”

“In this case, as bad as it is, it was discovered by someone who didn’t do malicious things with it. Sure, the data, sitting unprotected, could have also been used by the bad guys, but so far, no one has made that case or provided evidence that it has been used maliciously,” Grimes added.

“Anyone can have a mistake. The most important question is how the mistake happened and how to prevent it from happening next time, and if any others could have happened from the same set of circumstances.”

As a result of this incident, the company said it began notifying impacted customers whose data was present in the exposed Customer Service and Support database.


This content, and any other content on TLS, may not be republished or reproduced without prior permission from TLS. Copying or reproducing our content is both against the law and against Halacha. To inquire about using our content, including videos or photos, email us at [email protected].

Stay up to date with our news alerts by following us on Twitter, Instagram and Facebook.

**Click here to join over 20,000 receiving our Whatsapp Status updates!**

**Click here to join the official TLS WhatsApp Community!**

Got a news tip? Email us at [email protected], Text 415-857-2667, or WhatsApp 609-661-8668.