Details of 250 million customers were endangered due to poor configuration. Information collected by a call center was stored on unprotected Elasticsearch cloud servers.

Microsoft responsible for the breach kept databases unsecured on 5 servers. The leakage was spotted nearly a month ago.

Phone talks recorded up to 14 years ago by the Microsoft Customer Service and Support were stored with no password protection.

How to protect sensitive data in 4 steps

Removal of PII didn’t minimise the breach consequences significantly as IP addresses, emails of clients and support agents, descriptions of cases and requests were exposed.

Social engineering can be among the most likely scenarios. Knowing these details, including actual issues with which each customer applied, violators can perform the role of Microsoft employees and obtain what they hunt for.