Microsoft Data Breach History: 4 Confirmed Intrusions Since 2020, Kept Apart From Attacks on Customers

Microsoft data breach history, as of November 2, 2026: we count 4 confirmed intrusions of Microsoft’s own systems or services since January 2020, the latest being Midnight Blizzard, disclosed January 19, 2024. Exchange in 2021 and SharePoint in 2025 were attacks on customers’ servers, a separate lane. No new Item 1.05 8-K has followed.

The three-lane history

Many lists put Midnight Blizzard, Hafnium and an open Power Apps portal in one column. They differ in who was breached and in what a client must do, so we split them. Numbers match the table below, a ringed dot is an intrusion we count, and a hollow dot is an exposure with no attacker stated.

The stripe on each row shows the lane: navy for Microsoft itself, red for customers through a product flaw, blue for the customer side. Dates are the date of the cited document where that is how the event became public, so an incident can start earlier.

How many times has Microsoft been hacked?

4 times from January 1, 2020 to November 2, 2026, under this definition: a malicious actor gained unauthorized access to systems or services Microsoft itself runs, and Microsoft or a U.S. government document confirms it. Microsoft publishes no count. Its October 28, 2026 Form 10-Q says only that “we have experienced cybersecurity incidents in which such actors have gained unauthorized access to our systems and data, as well as customer, partner, and supplier systems and data.”

The count does not rise with product flaws. Hafnium and ToolShell hit servers that customers operated, and Microsoft’s role there was the vendor of the flawed software. Whether you call that a “Microsoft breach” is a choice, which is one reason totals can differ between lists.

Lane 1: breaches of Microsoft itself

Midnight Blizzard. The January 19, 2024 8-K says Microsoft detected on January 12 that a nation-state associated actor had been in employee email since late November 2023. Exhibit 99.1 gives the entry point: a password spray on a legacy, non-production test tenant account, which Microsoft’s January 25 guidance says had no multifactor authentication. The March 8, 2024 8-K/A added access to some source code repositories and internal systems, and its exhibit reported password sprays up as much as 10-fold in February. Microsoft has filed nothing further under Item 1.05 on its EDGAR list, and it told the SEC staff on June 28, 2024 that it would amend if the effect became material. For how this filing sits among other companies’ disclosures, see every Item 1.05 filing.

Storm-0558. Microsoft’s July 11, 2023 post says investigation began from a customer report on June 16, and put the toll at approximately 25 organizations. The Cyber Safety Review Board report, dated March 20, 2024, counts 22 enterprise organizations and 503 personal accounts, finds the intrusion “preventable,” and describes “a cascade of security failures at Microsoft.” The documents do not reconcile the two counts. Microsoft’s September 6, 2023 root-cause post pointed to a 2021 crash dump. The Board says Microsoft told it in November 2023 that this post was inaccurate and did not correct it until March 12, 2024. Microsoft’s addendum calls the path a “leading hypothesis,” and the Board says Microsoft “does not know” how the key was obtained, so no page should state the crash dump as fact.

Solorigate and DEV-0537. Both are smaller. In the February 18, 2021 final update, Microsoft says it found no access to production services or customer data, while some code for small subsets of Azure, Intune and Exchange was downloaded. In the March 22, 2022 post, it says a single account was compromised and no customer code or data was involved.

Lane 2: customers attacked through a Microsoft product flaw

These incidents leave Microsoft’s own network out of it, and they do not show up as Microsoft 8-Ks. Exchange in March 2021 and SharePoint in July 2025 both hit servers customers ran. Microsoft says the ToolShell flaws “do not affect SharePoint Online,” names exploitation attempts from July 7, 2025, and recommends rotating ASP.NET machine keys after patching, since stolen keys can outlast the patch. CISA added CVE-2025-53770 on July 20, 2025, with a one-day federal deadline.

SharePoint is the 2026 story. It accounts for 8 of 40 Microsoft additions this year, against 3 of 39 in 2025, and four came in July alone. 7 of the 8 carry a three-day federal deadline. The catalog does not say who was hit. Of all 390 Microsoft entries, 117 are flagged for known ransomware use, and Microsoft makes up 22% of the 1,766-entry catalog. Our KEV analysis covers the full list, and Patch Tuesday statistics shows the monthly CVE volume behind it.

Directive and KEV table

KEV started after the first four directives, so those flaws show a 2021 add date. CVE-2025-53771, the bypass Microsoft fixed in the same updates, and CVE-2025-53786 were not in the catalog we read. Only ED 24-02 concerns a breach of Microsoft itself. In CISA’s directive listing, we saw no later Microsoft emergency directive: ED 26-01 covers F5 and ED 26-03 covers Cisco SD-WAN.

A CVE is not a breach. The CVE record for CVE-2026-42824, published June 4, 2026 by Microsoft as an M365 Copilot information disclosure flaw, is not in KEV, and the record alleges no attack on anyone.

Lane 3: customer misconfiguration and identity

The cleanest case is UpGuard’s Power Apps report of August 23, 2021: 38 million records at 47 notified entities, readable because lists ignored table permissions unless a developer turned them on. UpGuard, not Microsoft, is the source for those counts, and it reports that Microsoft released a Portal Checker and planned to enforce table permissions by default. Microsoft was also among the organizations notified, which shows how blurry this lane can be.

2026 filings carry similar headlines. Stryker’s March 2026 8-K reports “a global disruption to the Company’s Microsoft environment,” and its April amendment calls the impact material, yet neither names a Microsoft flaw. IEH Corp’s August 2026 8-K describes an employee typing credentials into a fake login page. Both are customer incidents that involve Microsoft products. Our 2026 cyber attacks tracker lists them with the rest of this year’s filings. Aggregator pages also list unverified 2026 claims against Microsoft. We found nothing to support them in Microsoft’s filings, so they are not in the table.

What this means for MSPs

Each lane gives a different answer to the question clients ask: “Are we affected?”

• Lane 1, ask what you sent Microsoft. Midnight Blizzard took secrets customers had emailed to Microsoft. Search support tickets and mail to Microsoft for passwords, API keys and connection strings, rotate what you find, and stop sending them that way.
• Test and legacy tenants. Microsoft’s own entry point was a legacy test tenant account without MFA. List every trial, demo and former-project tenant in your client base, enforce MFA or delete them, and review OAuth applications with high permissions, the follow-on technique in Microsoft’s guidance.
• Mail audit logs. The State Department caught Storm-0558 through MailItemsAccessed events, and CISA’s July 2023 advisory tied that premium logging to G5/E5 licensing at the time. Confirm what each client tenant records today, how long it is kept and who reads it.
• On-premises SharePoint. Inventory every internet-facing server. Patch, rotate ASP.NET machine keys, restart IIS, and hunt for the web shell Microsoft names, spinstall0.aspx. With 8 KEV additions in 2026, plan for three-day patch windows or take the server off the internet.
• Exchange hybrid. ED 25-02 directs agencies to run the Exchange Server Health Checker, apply the April 2025 hotfix guidance and disconnect end-of-life servers. Federal deadlines do not bind private clients, but the steps apply to any hybrid tenant, including a server left over from a migration.
• Portals and storage links. Run the Power Apps Portal Checker on client portals and check that table permissions are on. Review Azure SAS tokens for long lifetimes and broad rights, since one token published to GitHub caused the 38 terabyte exposure.
• Client reporting. Say which lane an incident sits in. “Microsoft was breached” and “your unpatched server was attacked” call for different letters, different insurer notices and different fixes.

Frequently asked questions

How many times has Microsoft been hacked?

Under our definition, 4 times from January 2020 to November 2, 2026: Solorigate source-code access (2020), a DEV-0537 account (2022), Storm-0558 forged tokens in Exchange Online (2023) and Midnight Blizzard email theft (2023 to 2024). Adding 3 exposures with no attacker stated gives 7. Microsoft gives no count of its own.

Has Microsoft had a data breach in 2026?

We found none confirmed. Microsoft’s EDGAR list shows no Item 1.05 8-K after March 8, 2024, and its October 28, 2026 10-Q describes past incidents in general terms without a new one. CISA did add 40 Microsoft flaws to its exploited list through October 30, 2026, but those are attacks on customer systems.

Was customer data taken in the Midnight Blizzard attack?

Microsoft said on March 8, 2024 that it had no evidence Microsoft-hosted customer-facing systems were compromised, but secrets shared between customers and Microsoft in email were among stolen data and it was contacting those customers. CISA’s ED 24-02 of April 2, 2024 says email between federal agencies and Microsoft was exfiltrated.

What was the Storm-0558 breach?

From May 15, 2023, an actor Microsoft calls China-based used a stolen consumer signing key to forge tokens for Exchange Online. The Cyber Safety Review Board counted 22 enterprise organizations and 503 personal accounts, and about 60,000 State Department emails. It says Microsoft does not know how the key was obtained.

Was the SharePoint ToolShell attack a Microsoft data breach?

No, not of Microsoft itself. Microsoft says the July 2025 flaws affected on-premises SharePoint servers only, not SharePoint Online, and customers ran those servers. CISA added CVE-2025-53770 to KEV on July 20, 2025 with a one-day federal deadline.

Did the SEC act against Microsoft over the breach?

The record we read shows a staff comment letter dated June 17, 2024, asking why Microsoft filed under Item 1.05, and Microsoft’s June 28, 2024 reply saying it did not believe reputational harm was reasonably likely to be material. Neither document mentions a penalty.

Methodology

References

1. Microsoft Corp., Form 8-K, Item 1.05, January 19, 2024. Accessed November 2026.
2. Exhibit 99.1, Microsoft Actions Following Attack by Nation State Actor Midnight Blizzard. Accessed November 2026.
3. Microsoft Corp., Form 8-K/A, March 8, 2024. Accessed November 2026.
4. Exhibit 99.1, Update on Microsoft Actions, March 8, 2024. Accessed November 2026.
5. Microsoft response to SEC staff comments, June 28, 2024. Accessed November 2026.
6. Microsoft Corp., Form 10-Q for the quarter ended September 30, 2026. Accessed November 2026.
7. SEC EDGAR, Microsoft 8-K filing list. Accessed November 2026.
8. Microsoft, Midnight Blizzard guidance for responders, January 25, 2024. Accessed November 2026.
9. CISA, ED 24-02. Accessed November 2026.
10. Microsoft MSRC, Storm-0558 mitigation, July 11, 2023. Accessed November 2026.
11. Microsoft MSRC, Storm-0558 key acquisition, September 6, 2023, updated March 12, 2024. Accessed November 2026.
12. CISA and FBI, AA23-193A. Accessed November 2026.
13. Cyber Safety Review Board, Review of the Summer 2023 Microsoft Exchange Online Intrusion. Accessed November 2026.
14. Microsoft, HAFNIUM targeting Exchange Servers, March 2, 2021. Accessed November 2026.
15. CISA, ED 21-02. Accessed November 2026.
16. U.S. Department of Justice, Xu Zewei arrest, July 8, 2025. Accessed November 2026.
17. Microsoft MSRC, Customer guidance for CVE-2025-53770, July 19, 2025. Accessed November 2026.
18. Microsoft, Disrupting active exploitation of on-premises SharePoint vulnerabilities, July 22, 2025. Accessed November 2026.
19. CISA alert on CVE-2025-53770, July 20, 2025. Accessed November 2026.
20. CISA, ED 25-02. Accessed November 2026.
21. CISA, ED 20-03. Accessed November 2026.
22. CISA, ED 20-04. Accessed November 2026.
23. CISA, ED 21-04. Accessed November 2026.
24. CISA, Directives listing. Accessed November 2026.
25. Microsoft MSRC, SAS token exposure, September 18, 2023. Accessed November 2026.
26. Wiz Research, 38 terabytes exposure, September 18, 2023. Accessed November 2026.
27. Microsoft MSRC, Misconfigured Microsoft storage location, October 19, 2022. Accessed November 2026.
28. Microsoft MSRC, Customer support database, January 22, 2020. Accessed November 2026.
29. Microsoft MSRC, Solorigate final update, February 18, 2021. Accessed November 2026.
30. Microsoft, DEV-0537, March 22, 2022. Accessed November 2026.
31. Microsoft MSRC, Azure Cosmos DB Jupyter Notebook, August 27, 2021. Accessed November 2026.
32. UpGuard, Power Apps exposure, August 23, 2021. Accessed November 2026.
33. CISA, Known Exploited Vulnerabilities catalog, JSON feed. Accessed November 2026.
34. CISA, KEV catalog page. Accessed November 2026.
35. CVE Program, CVE-2026-42824 record. Accessed November 2026.
36. Washington Attorney General, Data Breach Notifications. Accessed November 2026.
37. California Attorney General, Data Security Breach Reports. Accessed November 2026.
38. Stryker Corp., Form 8-K, March 2026. Accessed November 2026.
39. Stryker Corp., Form 8-K/A, April 2026. Accessed November 2026.
40. IEH Corp., Form 8-K, August 2026. Accessed November 2026.