Microsoft denies data breach, theft of 30 million customer accounts

Microsoft has denied the claims of the so-called hacktivists “Anonymous Sudan” that they breached the company's servers and stole credentials for 30 million customer accounts.

Anonymous Sudan is known for debilitating distributed denial-of-service (DDoS) attacks against Western entities in recent months. The group has confirmed their affiliation with pro-Russian hacktivists like Killnet.

Last month, Microsoft admitted that Anonymous Sudan was responsible for service disruptions and outages at the beginning of June that impacting several of its services, including Azure, Outlook, and OneDrive.

Yesterday, the hacktivists alleged that they had “successfully hacked Microsoft” and “accessed a large database containing more than 30 million Microsoft accounts, emails, and passwords.”

Anonymous Sudan offered to sell this database to interested parties for $50,000 and urged interested buyers to engage in contact with their Telegram bot to arrange the purchase of the data.

The post even includes a sample of the data they offered (allegedly stolen from Microsoft) as proof of the breach and warned that Microsoft would deny those claims.

The group provided 100 credential pairs but their origin could not be verified (old data, the result of a breach at third-party service provider, stolen from Microsoft’s systems).

BleepingComputer has contacted Microsoft to request a comment on the validity of Anonymous Sudan's saying and a company spokesperson flatly denied any data breach claims.

“At this time, our analysis of the data shows that this is not a legitimate claim and an aggregation of data,” a company representative told BleepingComputer.

It is unclear at the moment if Microsoft's investigation is complete or it's ongoing. Also, the company's reaction to the potential public release of the data remains to be seen.

Source