INCIDENT REPORT · CP-2024-001
Midnight Blizzard compromise of Microsoft corporate email
L3 · ELEVATEDCONFIRMED
Microsoft disclosed in an SEC 8-K and blog post on 19 January 2024 that a nation-state actor had accessed a small percentage of its corporate email accounts. Microsoft detected the intrusion on 12 January 2024.
- Incident ID
- CP-2024-001
- Disclosure date
- 19 JAN 2024
- Detection date
- 12 JAN 2024
- Affected countries
- United States
- Plotted location
- Redmond, United States (Affected organization headquarters)
- Threat classification
- Level 3 — ELEVATED
- Classification rationale
- State espionage against a major technology provider's senior leadership and security teams.
- Attack type
- Espionage
- Nature
- Malicious activity
- Attack vector
- Password spray attack that compromised a legacy non-production test account, starting in late November 2023
- Sectors
- Technology
- Critical infrastructure
- No
- Organizations affected
- Microsoft
- Operational consequences
- Emails and attached documents were exfiltrated from accounts of senior leadership and staff in cybersecurity, legal and other functions. Microsoft said the incident had not had a material impact on its operations as of the filing.
- Estimated financial impact
- No reliably documented figure
- Attribution (as stated)
- Attributed by Microsoft to Midnight Blizzard (also known as Nobelium / APT29), a Russian state-sponsored actor
SOURCE REFERENCES
- [1] Microsoft breached by Russian APT behind SolarWinds attackTechTarget · techtarget.com
- [2] Microsoft Says State-Sponsored Attackers Accessed Senior Leaders' EmailsTechRepublic · techrepublic.com
RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.