Microsoft says law enforcement documents likely stolen by hackers

Social media and email accounts of some Microsoft employees were hit by phishing attacks, the company said
  • John Ribeiro (IDG News Service)
  • — 27 January, 2014 04:06

Documents linked with law enforcement inquiries appear to have been stolen in recent phishing attacks on certain employee email accounts, Microsoft said.

The technology giant said earlier this month that a small number of Microsoft employee social media and email accounts had been impacted in a phishing attack. The accounts were reset and no customer information was compromised, Microsoft said.

On Friday, Adrienne Hall, general manager in Microsoft's Trustworthy Computing Group, said in a blog post that it appeared that documents associated with law enforcement inquiries were stolen. "If we find that customer information related to those requests has been compromised, we will take appropriate action," Hall said.

The company will, however, not comment on the validity of any stolen emails or documents in deference to "the privacy of our employees and customers -- as well as the sensitivity of law enforcement inquiries," she added.

Microsoft said its investigation continues, and that the type of attack was not uncommon, as many companies face phishing attempts from cybercriminals.

The company has been recently targeted by the Syrian Electronic Army, a hacker group that supports the Syrian regime of Bashar al-Assad. SEA attacked this month the social media properties of Skype and other Microsoft social media and blogs, including the Microsoft Office Blogs site.

In a message on Twitter, SEA accused Microsoft of selling customer data to governments, which was probably a reference to disclosures last year by former U.S. National Security Agency contractor, Edward Snowden, that Internet companies were allegedly providing access to real-time customer data to the agency.

Microsoft receives requests for customer data from law enforcement agencies around the world relating to Microsoft online and cloud services. Some of these are covered under "gag orders," which do not allow the company to disclose to the public the existence of the specific requests.

In March last year it started publishing its Law Enforcement Requests Report, which listed the total number of requests it receives from law enforcement agencies in countries around the world and the number of potentially affected accounts identified in those requests. Microsoft, Google and some other Internet companies have asked the Foreign Intelligence Surveillance Court for permission to provide aggregate data on security information requests under the Foreign Intelligence Surveillance Act, which they are currently disallowed.

John Ribeiro covers outsourcing and general technology breaking news from India for The IDG News Service. Follow John on Twitter at @Johnribeiro. John's e-mail address is john_ribeiro@idg.com

Tags: security, Microsoft, Syrian Electronic Army

Google patches Android icon permissions attack

READ THIS ARTICLE
DO NOT SHOW THIS BOX AGAIN [ x ]
Comments are now closed.
CSO Corporate Partners
  • Webroot
  • Trend Micro
  • NetIQ
rhs_login_lockGet exclusive access to CSO, invitation only events, reports & analysis.
CSO Directory

Endpoint Encryption

Robust data protection for PCs, smartphones, and removable media

Latest Jobs
Security Awareness Tip

Incident handling is a vast topic, but here are a few tips for you to consider in your incident response. I hope you never have to use them, but the odds are at some point you will and I hope being ready saves you pain (or your job!).


  1. Have an incident response plan.

  2. Pre-define your incident response team 

  3. Define your approach: watch and learn or contain and recover.

  4. Pre-distribute call cards.

  5. Forensic and incident response data capture.

  6. Get your users on-side.

  7. Know how to report crimes and engage law enforcement. 

  8. Practice makes perfect.

For the full breakdown on this article

Security ABC Guides

Warning: Tips for secure mobile holiday shopping

I’m dating myself, but I remember when holiday shopping involved pouring through ads in the Sunday paper, placing actual phone calls from tethered land lines to research product stock and availability, and actually driving places to pick things up. Now, holiday shoppers can do all of that from a smartphone or tablet in a few seconds, but there are some security pitfalls to be aware of.