“Intruders” in the cloud: Microsoft warns “thousands” of Azure customers about potential exposure

In recent months, a string of cyberattacks has rippled through critical aspects of U.S. infrastructure ranging from petroleum and meat production to local water supplies, leading to gas shortages and big ransomware payouts. On Thursday, Microsoft alerted cloud customers that uninvited guests could have access to their databases, according to Reuters.

SEE: Security incident response policy (TechRepublic Premium)

Intruders in the cloud: What happened?

On Thursday, Microsoft sent warnings to “thousands” of the company’s cloud computing customers, explaining that “intruders could have the ability to read, change or even delete their main databases,” according to a Reuters report published the same day citing a cybersecurity researcher and a copy of the warning email.

Researchers at the cybersecurity company Wiz found the vulnerability in Microsoft Azure’s Cosmos DB database, according to Reuters, and were “able to access keys that control access to databases held by thousands of companies.” Since Microsoft is unable to change these keys, Reuters said the company emailed customers directing them to make new keys.

The Microsoft warning to customers said the company had “no indication that external entities outside the researcher (Wiz) had access to the primary read-write key,” according to Reuters.

SEE: How to manage passwords: Best practices and security tips (free PDF) (TechRepublic)

The Wiz team discovered the flaw in Jupyter Notebook earlier this month and alerted Microsoft a few days later and the company was paid $40,000 for finding the vulnerability, according to Reuters. Wiz’s Chief Technology Officer Ami Luttwak described the flaw as “the worst cloud vulnerability you can imagine. It is a long-lasting secret,” adding that they “were able to get access to any customer database that we wanted,” in an interview with Reuters. 

“We fixed this issue immediately to keep our customers safe and protected. We thank the security researchers for working under Coordinated Vulnerability Disclosure,” said a Microsoft spokesperson.

Ransomware payouts surge

A number of high-profile cyberattacks have brought conversations surrounding security front and center for companies around the globe. On average, ransomware payments surged 82% to $570,000 in the first six months of 2021, according to Unit 42’s Ransomware Threat Report.

In the aftermath of the Colonial Pipeline attack, the company paid DarkSide hackers more than $4 million, according to a Wall Street Journal interview with the CEO. Following the JBS attack, the company paid the REvil group a whopping $11 million.

Cybersecurity Insider Newsletter

Strengthen your organization’s IT security defenses by keeping abreast of the latest cybersecurity news, solutions, and best practices.
Delivered Tuesdays and Thursdays

Sign up today

Also see