Breach taxonomy
Summary
Beginning in late November 2023, a nation-state associated threat actor gained unauthorized access to Microsoft employee email accounts, including members of senior leadership and cybersecurity and legal staff. The attacker exfiltrated information from a very small percentage of employee email accounts. Microsoft detected the intrusion on January 12, 2024 and removed the threat actor's access on or about January 13, 2024. As of the filing date, no material operational impact had been determined.
Tagging rationale
ThreatNation State
Filing explicitly states a nation-state associated threat actor had gained access — direct attribution to nation-state actor.
MethodsData Exfil
Filing confirms the threat actor gained access to and exfiltrated information from email accounts; no initial access vector is described in this initial disclosure.