Photo: Pixabay
In a blog post on Tuesday, Microsoft confirmed that one of its accounts was breached by the hacker group Lapsus$, resulting in “limited access” to company systems but not the data of any Microsoft customers.
“Our cybersecurity response teams quickly engaged to remediate the compromised account and prevent further activity,” Microsoft said.
Lapsus$ had recently claimed credit for compromising Okta, the digital identity management firm, prompting Microsoft to confirm the breach. On Tuesday evening, Okta also acknowledged that they had been affected by a breach in January linked to one of Okta’s outside contractors following an investigation into Lapsus$’s claims.
Lapsus$ previously claimed to have breached chip giant Nvidia. Nvidia also confirmed a breach to CNN earlier this month.
Microsoft added on Tuesday that Microsoft’s approach to risk management means possessing the code would not benefit the hackers even if they had managed to access it. This pronouncement was made after Lapsus$ claims to have stolen the Microsoft source code.
“Microsoft does not rely on the secrecy of code as a security measure and viewing source code does not lead to elevation of risk,” Microsoft said.
Microsoft added that the techniques Lapsus$ used in the attack on company systems were consistent with those Microsoft has observed the group using against other targets.
Microsoft said that, in the past, Lapsus$ has sought to steal individual user credentials to gain access to an organization or corporate network. Then, the group would comb through office collaboration tools such as SharePoint, Teams, and Slack to discover other users on the network whose accounts could be targeted to deepen the compromise.
Microsoft added that Lapsus$ has even been known to listen to victims’ conference calls to discuss the breach response.
Microsoft described Lapsus$ as having a sophisticated grasp of technology supply chains and understanding how to use one organization’s relationships or reliance on another. In addition to tech, telecom, and IT support firms, Lapsus$ has “also been observed targeting government entities, manufacturing, higher education, energy, retailers, and healthcare,” Microsoft said.
