INCIDENT REPORT · CP-2021-001

Microsoft Exchange Server mass exploitation (Hafnium)

L3 · ELEVATEDCONFIRMED

Attackers exploited four vulnerabilities in on-premises Microsoft Exchange Server. Microsoft attributed the initial activity to a group it calls HAFNIUM, and wider exploitation followed disclosure.

Incident ID: CP-2021-001
Disclosure date: 02 MAR 2021
Detection date: Not publicly documented
Affected countries: United States
Plotted location: Redmond, United States (Vendor of the exploited product (Microsoft); victims were worldwide)
Threat classification: Level 3 — ELEVATED
Classification rationale: Mass exploitation of a widely used server product across many organizations and sectors, without demonstrated large-scale disruption of essential services.
Attack type: Vulnerability Exploitation
Nature: Malicious activity
Attack vector: Chained zero-day vulnerabilities in on-premises Microsoft Exchange Server, including CVE-2021-26855 (server-side request forgery)
Sectors: Government, Technology, Healthcare, Education, Finance
Critical infrastructure: Yes
Organizations affected: Organizations running on-premises Microsoft Exchange Server worldwide
Operational consequences: CISA issued Emergency Directive 21-02 and Alert AA21-062A on 3 March 2021. Tens of thousands of servers worldwide were reported compromised.
Estimated financial impact: No reliably documented figure
Attribution (as stated): Attributed by Microsoft to HAFNIUM; attributed by the US government, EU, UK and NATO (19 July 2021) to actors affiliated with China's Ministry of State Security

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

Microsoft Exchange Server mass exploitation (Hafnium)

L3 · ELEVATEDCONFIRMED

Attackers exploited four vulnerabilities in on-premises Microsoft Exchange Server. Microsoft attributed the initial activity to a group it calls HAFNIUM, and wider exploitation followed disclosure.

Incident ID

CP-2021-001

Disclosure date

02 MAR 2021

Detection date

Not publicly documented

Affected countries

United States

Plotted location

Redmond, United States (Vendor of the exploited product (Microsoft); victims were worldwide)

Threat classification

Level 3 — ELEVATED

Classification rationale

Mass exploitation of a widely used server product across many organizations and sectors, without demonstrated large-scale disruption of essential services.

Attack type

Vulnerability Exploitation

Nature

Malicious activity

Attack vector

Chained zero-day vulnerabilities in on-premises Microsoft Exchange Server, including CVE-2021-26855 (server-side request forgery)

Sectors

Government, Technology, Healthcare, Education, Finance

Critical infrastructure

Yes

Organizations affected

Organizations running on-premises Microsoft Exchange Server worldwide

Operational consequences

CISA issued Emergency Directive 21-02 and Alert AA21-062A on 3 March 2021. Tens of thousands of servers worldwide were reported compromised.

Estimated financial impact

No reliably documented figure

Attribution (as stated)

Attributed by Microsoft to HAFNIUM; attributed by the US government, EU, UK and NATO (19 July 2021) to actors affiliated with China's Ministry of State Security