How Russian spies read Microsoft executives' email: a forgotten test account

The company that sells security software to much of the world had its senior leaders' email read by foreign spies, and the way in was an old test account that nobody had protected with a second login step.^[1][2] This case file covers what Microsoft disclosed in 2024, how the intruders moved from a forgotten account to executive inboxes, what it cost, and the one control that was missing.

What happened

How they got in

The intrusion began in late November 2023, weeks before anyone noticed.^[6] Microsoft's own guidance for responders laid out the path.^[1] The attackers began with password spraying: trying a few common passwords against many accounts, slowly, so as not to trip alarms. They sent the attempts through ordinary home internet connections to hide where they came from.

The account that fell was a legacy test account in a non-production setup, not a live employee's login. Microsoft said it did not have multi-factor authentication (MFA), the second step such as a phone prompt or code that stops a guessed password from being enough.^[1]

That test environment still had a connection into Microsoft's real corporate environment. The attackers found an old test application, a piece of software authorized to act on the company's behalf, that had been given broad permissions. They used it to create new applications and an account to approve them, and gave those applications permission to read corporate mailboxes.^[1] In short, a neglected test account led to a neglected test app, and that app had keys to the real building.

What it cost

Microsoft has not put a dollar figure on the breach. It said it found no evidence that the customer-facing systems it hosts had been compromised.^[4] But secrets such as passwords and access keys that customers had shared by email were exposed, and Microsoft began contacting the affected customers.^[4]

Some of those customers were US government agencies. In April 2024 the Cybersecurity and Infrastructure Security Agency issued an emergency directive ordering federal agencies to review the email they had exchanged with Microsoft and to reset any credentials that might have been exposed.^[5]

The missing control

The missing control: MFA on every account, including test and legacy ones. Microsoft said plainly that the account the attackers guessed their way into did not have MFA enabled.^[1]

Password spraying works only when a correct password is all an attacker needs. With a second factor on that test account, a guessed password would have led nowhere, and the attackers would have had to find another route. The second lesson rides on the first: test accounts and test apps that are old, forgotten and still connected to real systems should be removed or locked down to the same standard as production.

What to do in your business

• Find your forgotten accounts. Pull a list of every user account in your email and cloud services, including test, shared, trial and former-employee accounts, and disable the ones nobody uses.
• Turn on MFA for everyone. Require a second login step on every remaining account, with no exceptions for test or admin accounts.
• Review connected apps. Check which third-party apps have been granted access to your email or files, and remove any you do not recognize or no longer use.
• Keep secrets out of email. Share passwords and access keys through a password manager or secure portal, not in email where one breach exposes them.
• Watch for slow guessing. Ask your IT provider to alert on repeated failed logins across many accounts, even if each account sees only a few.

Facts are drawn from court records, government reports, company statements and reputable reporting, listed below. People are named only where they were convicted, pleaded guilty or spoke publicly in an official role.