Oops.. Microsoft exposes 250 million customer records

A "misconfiguration" of one of Microsoft's internal customer databases resulted in a massive data leak. Just before the turn of the year, security researcher Bob Diachenko and Comparitech discovered that the database, which was not protected by a password, was accessible to anyone via a web browser.

Microsoft fixed the issue on December 31, 2019 and claims they found no evidence of malicious use. In total, about 250 million customer service and support records were exposed. This includes chat logs going back as far as 2005.

The data contained in the records referred to conversations between customers and Microsoft's support teams, and most of the data in the logs was redacted as part of Microsoft's standard procedures. However, some data may have been left in plain text, including information such as e-mail addresses for customers and support agents, IP addresses, locations, case numbers, and confidential internal notes. As noted by the research team that discovered the issue, this information can be used by ill-intentioned actors to impersonate Microsoft support agents to scam customers. However, Microsoft notes that it didn't find any evidence of malicious use of the data.

The software giant promises it's taking action to prevent future reoccurrences.

Via: Neowin