MICROSOFT CORP

The intrusion ran through a legacy test tenant Microsoft had left standing with no multifactor authentication and a guessable password, which a password spray walked straight into. From there the attackers reached an old test OAuth app that still carried full access to corporate mailboxes, and read the email of senior leadership, cybersecurity, and legal. The perimeter that failed was not a network but a forgotten account the security giant never turned off; Microsoft named the actor as Midnight Blizzard, a Russian state group.