Everything from passwords to emails and other files are at risk. (Photo: Getty Images)Government and corporate computer systems have come under attack over the last several days by an unknown hacker group exploiting a hole in one of Microsoft’s most popular server software products.
The attack, a so-called zero-day attack because it targets a previously unknown vulnerability, affects on-premise versions of Microsoft Sharepoint software, which organizations often connect directly to Outlook and other core services,
the Washington Post reported on Sunday. That means everything from passwords to emails and other files are at risk.
According to sources the Post spoke to, at least two U.S. federal agencies have been breached, as have several European government agencies, universities, an energy company, and an Asian telecom company.
Microsoft issued a patch for one version of the software, but was still working on a patch for two other versions as of Sunday night, according to the Post. “Our team is working urgently to release a security update and will share more details as they become available,” Microsoft
said on X, linking to
blog post with more details of the attack and actions organizations can take.
CISA, the U.S. government’s cybersecurity agency, put out
an alert Sunday with steps to take to “reduce the risks,” along with a sobering description of what exactly those risks are: The hack “provides unauthenticated access to systems and enables malicious actors to fully access SharePoint content, including file systems and internal configurations, and execute code over the network.” Oof. —
AO