250 Million Microsoft Customer Support Records Exposed Online

Microsoft today admitted a security incident that exposed nearly
250 million “Customer Service and Support” (CSS) records on the
Internet due to a misconfigured server containing logs of
conversations between its support team and customers.

According to Bob Diachenko, a cybersecurity researcher who
spotted the unprotected database and reported to Microsoft, the
logs contained records spanning from 2005 right through to December
2019.

In a blog post, Microsoft confirmed that
due to misconfigured security rules added to the server in question
on December 5, 2019, enabled exposure of the data, which remained
the same until engineers remediated the configuration on December
31, 2019.
^[1]

Microsoft also said that the database was redacted using automated
tools to remove the personally identifiable information of most
customers, except in some scenarios where the information was not
the standard format.

“Our investigation confirmed that the vast majority of records
were cleared of personal information in accordance with our
standard practices,” Microsoft said.

However, according^[2]
to Diachenko, many records in the leaked database contained
readable data on customers, including their:

• email addresses,
• IP addresses,
• Locations,
• Descriptions of CSS claims and cases,
• Microsoft support agent emails,
• Case numbers, resolutions, and remarks,
• Internal notes marked as “confidential.”

“This issue was specific to an internal database used for support
case analytics and does not represent an exposure of our commercial
cloud services,” Microsoft said.

By having real sensitive case information and email addresses of
affected customers in hand, the leaked data could be abused by
tech-support scammers to trick users into paying for non-existent
computer problems by impersonating Microsoft support
representatives.

As a result of this incident, the company said it began
notifying impacted customers whose data was present in the
exposed Customer Service and Support database.