US government review faults Microsoft for ‘cascade’ of errors that allowed Chinese hackers to breach senior US officials’ emails
Microsoft committed a “cascade” of “avoidable errors” that allowed Chinese hackers to breach the tech giant’s network and later the email accounts of senior US officials last year, including the secretary of commerce, a scathing US government-backed review of the incident has found.
The hack “was preventable and should never have occurred,” says a report released Tuesday by the US Cyber Safety Review Board (CSRB), a group of government and private cybersecurity experts led by the Department of Homeland Security. It was set up by President Joe Biden in 2021 to study the root causes of major hacking incidents.
In particular, the review board faulted Microsoft (MSFT) for not adequately protecting a sensitive cryptographic key that allowed the hackers to remotely sign into their targets’ Outlook accounts by forging credentials “Microsoft’s security culture was inadequate and requires an overhaul” in light of the company’s “centrality in the technology ecosystem,” the report concludes. The hack roiled Washington and gave Chinese operatives access to the unclassified email accounts of senior US diplomats, including US Ambassador to China Nicholas Burns, on the eve of a high-profile visit by Secretary of State Antony Blinken to China last June, CNN has reported.
