Microsoft Confirms Details Of Security Breach

Most of that security article is devoted to Microsoft’s observation of LAPSUS$ and its methods, but there’s also a section where the company details the actions the hacker group has taken against it. Microsoft says that LAPSUS$ gained access to its internal systems via a single compromised account. “Our cyber security response teams quickly engaged to remediate the compromised account and prevent further activity,” Microsoft wrote, which goes along with LAPSUS$’s own claims that it lost access to Microsoft’s servers in the middle of its attack.

All in all, it sounds like the impact this LAPSUS$ attack had on Microsoft is minimal, if there was any impact at all. Microsoft says that “no customer code or data was involved in the observed activities.” Though the hackers did make off with source code for products like Cortana, Bing, and Bing Maps, Microsoft also said that it “does not rely on the secrecy of code as a security measure and viewing source code does not lead to elevation of risk.” In fact, Microsoft says that LAPSUS$ going public with this attack allowed its security team to intervene “mid-operation” and mitigate a “broader impact” before it happened.