Storm-0558 (Microsoft cloud email intrusion, 2023)
An intrusion by a China-linked group into the cloud email of about twenty-five organizations, including the US State Department, using a signing key stolen from Microsoft.
Cloud services authenticate users with tokens signed by keys that only the provider holds. The group obtained a key meant for consumer accounts and, through a validation error, was able to forge tokens that were also accepted for enterprise accounts. It thus read its targets' email without ever touching their own systems: no security measure on the customer's side could have stopped it. The intrusion was detected only because one customer had an advanced access log, then sold as an add-on. For insurance, the case shows the limit of the shared responsibility model: the risk sat entirely on the provider's side, and the ability to detect it depended on a subscription tier.
Microsoft disclosed the intrusion on July 11, 2023, after the State Department spotted it in June through its logs; about 60,000 of the department's emails were stolen, and Commerce Secretary Gina Raimondo was among the victims. Microsoft then extended those logs free of charge to more customers, and in April 2024 the Cyber Safety Review Board found the intrusion preventable.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.