China-linked hackers breached the corporate account of a Microsoft Corp. engineer and are suspected of using that access to steal a valuable key that enabled the hack of senior US officials’ email accounts, the company said in a blog post.
The hackers used the key to forge authentication tokens to access email accounts on Microsoft’s cloud servers, including those belonging to Commerce Secretary Gina Raimondo, Representative Don Bacon and State Department officials earlier this year.
Read more: Congressman Bacon Says Emails Hacked in China-Linked Campaign
The US Cybersecurity and Infrastructure Security Agency and Microsoft disclosed the breach in June, but it was still unclear at the time exactly how hackers were able to steal the key that allowed them to access the email accounts.
Microsoft said the key had been improperly stored within a “crash dump,” which is data stored after a computer or application unexpectedly crashes. The crash dump was then moved into Microsoft’s production environment, where a compromised account belonging to a Microsoft employee could access it. The key was stolen sometime after April 2021, the company said.
However, because Microsoft didn’t have relevant logs, it didn’t have complete confidence in its assessment of how the key was stolen, according to the blog.
“Due to log retention policies, we don’t have logs with specific evidence of this exfiltration by this actor, but this was the most probable mechanism by which the actor acquired the key,” Microsoft said in its blog.
Read more: Commerce Chief Raimondo’s Email Hacked in Breach Tied to China
The incident has brought fresh scrutiny to Microsoft’s cybersecurity practices. Following a demand by US Senator Ron Wyden, a Democrat from Oregon, for investigations into the incident, Bloomberg News reported that the Cyber Safety Review Board would study the incident, as well as other cloud security vulnerabilities.
In its blog post, Microsoft identified five different errors in how its systems are architected that have “been corrected.”