Cyber Incident Victim: Microsoft
Date:
Mar 2020
Location:
United States of America
Summary
A hacker compromised the organization's GitHub account, stealing over 500GB of data from private repositories including code samples, test projects, an eBook, and repositories such as 'wssd cloud agent' and 'PowerSweep'. The attacker initially intended to sell the data but later leaked portions publicly, though analysis indicated the material lacked sensitive core products like Windows or Office. Concerns were raised about potential exposure of accidental inclusions like private API keys or credentials in the repositories. The breach was confirmed as legitimate by an anonymous employee, prompting an internal investigation while public statements from the company acknowledged awareness of the incident.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On March 28, 2020, a hacker using the alias Shiny Hunters breached Microsoft’s GitHub account, gaining full access to its private repositories. The attacker downloaded over 500GB of data from these repositories, initially intending to sell the stolen information before opting to release it publicly at no cost. As evidence of the breach, Shiny Hunters provided BleepingComputer with a full directory listing of the exfiltrated files, which included timestamps pointing to the March 28 intrusion date. The hacker later lost access to Microsoft’s account but promoted the leak by offering 1GB of the stolen data on a hacker forum, requiring registered users to spend site credits to access it. Some forum users questioned the authenticity of the leak due to the presence of Chinese text and references to latelee.org in certain files.
The stolen data primarily consisted of code samples, test projects, an eBook, and generic items, with no evidence of sensitive Windows or Office source code. Notable repositories included projects named “wssd cloud agent,” “The Rust/WinRT language projection,” and a “PowerSweep” PowerShell utility. Cybersecurity analysts from BleepingComputer and the firm Under the Breach assessed the leak as low-risk for Microsoft, though they noted potential exposure if private API keys or passwords were inadvertently embedded in the repositories. Following BleepingComputer’s report, an anonymous Microsoft employee confirmed the legitimacy of the breach, prompting other employees who had publicly dismissed the leak as fake to delete their social media posts. Microsoft acknowledged the incident, stating it was aware of the claims and investigating. The company did not disclose further details about remediation efforts or the scope of internal reviews.