Microsoft Corp discloses a cybersecurity incident with data taken without authorization (SEC 8-K, January 2024)
On January 12, 2024, Microsoft (the “Company” or “we”) detected that beginning in late November 2023, a nation-state associated threat actor had gained access to and exfiltrated information from a very small percentage…
What happened
- On January 12, 2024, Microsoft (the “Company” or “we”) detected that beginning in late November 2023, a nation-state associated threat actor had gained access to and exfiltrated information from a very small percentage of employee email accounts including members of our senior leadership team and employees in our cybersecurity, legal, and other functions, on the basis of preliminary analysis.Form 8-K Item 1.05, Microsoft Corp, filed 2024-01-19
- We were able to remove the threat actor’s access to the email accounts on or about January 13, 2024.Form 8-K Item 1.05, Microsoft Corp, filed 2024-01-19
- We are examining the information accessed to determine the impact of the incident.Form 8-K Item 1.05, Microsoft Corp, filed 2024-01-19
- We are also notifying relevant regulatory authorities with respect to unauthorized access to personal information.Form 8-K Item 1.05, Microsoft Corp, filed 2024-01-19
The failure pattern
Watch the pattern: Audit trail missing actor, target or decision
Related standards
CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.
Building something similar?
Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.
Incidents with the same pattern
Amgen Inc discloses a cybersecurity incident with data taken without authorization (SEC 8-K, July 2026)
In July 2026, Amgen Inc. (the "Company") identified unauthorized activity involving data stored in cloud environments hosted by third-party cloud service providers.
Ufp Technologies Inc discloses a cybersecurity incident with data taken without authorization (SEC 8-K, February 2026)
On or about February 14, 2026, UFP Technologies, Inc. (the “Company”) detected suspicious activity involving its information technology (“IT”) systems.
AT&T Inc. discloses a cybersecurity incident with data taken without authorization (SEC 8-K, July 2024)
On April 19, 2024, AT&T Inc. (“AT&T”) learned that a threat actor claimed to have unlawfully accessed and copied AT&T call logs.
Orasure Technologies Inc discloses a cybersecurity incident with data taken without authorization (SEC 8-K, April 2024)
On or about March 27, 2024, OraSure Technologies, Inc. (the “Company”) became aware of a cybersecurity incident in which an unauthorized third party gained access to Company data from certain information systems.
Cencora, Inc. discloses a cybersecurity incident with data taken without authorization (SEC 8-K, February 2024)
On February 21, 2024, Cencora, Inc. (the “Company”), learned that data from its information systems had been exfiltrated, some of which may contain personal information.
Hewlett Packard Enterprise Co discloses a cybersecurity incident with data taken without authorization (SEC 8-K, January 2024)
On December 12, 2023, Hewlett Packard Enterprise Company (the “Company,” “HPE,” or “we”) was notified that a suspected nation-state actor, believed to be the threat actor Midnight Blizzard, the state-sponsored actor also…