NOT AGAIN — The Kremlin-backed hackers who breached Microsoft’s systems earlier this year didn't just peek at staff inboxes — they also nabbed customer emails. This revelation, coming six months after the initial disclosure, significantly broadens the impact of the Midnight Blizzard attack. The timing couldn't be worse for Microsoft. Already under the congressional microscope for a separate Chinese hack that snagged U.S. government emails, the company again faces tough questions about its cybersecurity chops and transparency. "We are continuing notifications to customers who corresponded with Microsoft corporate email accounts that were exfiltrated by the Midnight Blizzard threat actor, and we are providing the customers the email correspondence that was accessed by this actor,” company spokesperson Kate Frischmann said in a statement over the weekend. — Cyber woes far from over: House Homeland Security Committee ranking member Bennie Thompson (D-Miss.) tells MC he’s keeping tabs on Microsoft’s promised security reforms. When asked whether this could trigger another Microsoft hearing down the line, Thompson said he will “closely monitor” both the federal response and the company’s efforts to deal with the “entirely avoidable” breach. “These new notifications serve as a reminder that the government has a national security obligation to evaluate the degree to which reliance in a single vendor creates risk and how that risk can be mitigated and I am committed to making sure that happens,” Thompson said. — Action on the horizon: Senate Armed Services Committee member Sen. Eric Schmitt (R-Mo.) in June introduced two amendments taking aim at Microsoft in the 2025 National Defense Authorization Act. Those amendments would:
- Allow Pentagon entities to seek alternative cybersecurity services.
- Require defense contractors operating in China to disclose if forced to share vulnerabilities with Beijing.
— The intrigue: Microsoft's dominance in federal IT has long been a given. But with these security slip-ups piling up, that could change. The Senate amendments, while not naming names, are a thinly veiled swipe at Microsoft's cozy relationship with the Pentagon and its presence in China. Still, Microsoft’s cyber troubles are looking like they’re more than just a PR headache. National security concerns for the company could kick-start another round of grueling congressional hearings. CYBER CASH — In a razor-thin 212-203 vote, House Republicans pushed through a contentious Homeland Security appropriations bill that includes a $2.9 billion cybersecurity funding package late last week. The near party-line vote hands a solid budget boost to CISA for 2025, but not without some controversy. — Under the hood: The bill earmarks $2.4 billion for CISA operations and another $494 million for procurement, which promises to amp up America’s cyber defenses. A key provision also allows CISA to share threat feeds with state and local entities. — What’s next: The bill in general lurches to the Republican right, and the Democrat-led Senate hasn’t even introduced their version of the appropriations bills yet. Nothing is on the schedule yet, and the Senate is off for holiday this week, but we expect a rocky road ahead.
| 
No comments:
Post a Comment