Russian SVR group breach of corporate email (Cozy Bear)
Data compromised
Email addresses, Passwords
Technical writeup
Microsoft discovered a breach by a Russian SVR foreign intelligence group on January 12. The incident occurred in November 2023 via password spraying against Microsoft's corporate email system. Cozy Bear (linked to SolarWinds) compromised a legacy test account and accessed senior leadership accounts. Access was removed on January 13.
Root cause
Password spraying; compromised legacy test account with outdated code.