The company discovered on Dec. 5 that a change within the database’s network security group had misconfigured security rules. The misconfiguration may have caused some data to be exposed. Microsoft engineers fixed the misconfiguration Dec. 31 to stop unauthorized access.
There is no evidence that any information stored in the database has been misused. Microsoft said its internal database used for support case analytics was solely affected. The company’s commercial cloud services were not involved.
Much of the data stored in the support case analytics database is redacted. Only a limited amount of data was unredacted if it met specific conditions. Microsoft is notifying consumers whose data was not redacted.
Since the incident, Microsoft has begun auditing the established network security rules for internal resources, added additional alerting systems, implemented additional redaction automation and expanded its scope of detecting security rule misconfigurations.
More articles on cybersecurity:
Health systems should update computer systems in wake of Iran tensions, H-ISAC says
3 cybersecurity predictions for 2020
Former NYC hospital employee pleads guilty to hacking coworkers’ emails
Becker’s 3rd Annual Fall Chief Pharmacy Officer Summit is the top tier event that the people leading the future of pharmacy convene. This 3-day event is built specifically for Chief Pharmacy Officers and senior pharmacy leaders. The sessions examine the workforce, financial and clinical priorities shaping pharmacy today. Becker’s is where candid discussions flourish and new ideas thrive. Becker's 3rd Annual Fall Chief Pharmacy Officer Summit
