how it happened
- whoStorm-0558stole a 2016 signing key
- the gapMicrosoft validation bugconsumer key opened enterprise mail
- the result~500 people, 22 orgscaught by State Dept logs
what everyone assumed
If you run cloud email, you reason about access through identity: the company is the set of people allowed to sign in, and the provider checks each one at the door. It is a reasonable belief, and it is how the product is sold. The door was real. The lock behind it had a flaw nobody at any of these organizations could have seen.
what happened
The key at the center of this was issued in 2016, meant only to sign tokens for consumer accounts. Through a validation error in Microsoft’s own code, a token signed by that key could be made to open enterprise mailboxes too. Storm-0558 obtained the key and forged the tokens. To each affected organization, nothing looked wrong, because nothing on their side was wrong. The sign-ins were valid by every check available to them. The compromise lived in the provider’s token validation, a layer no customer can inspect, and it kept working as long as it went unnoticed.
step by step
- 2016a key is issued to sign consumer tokensOnly consumer accounts were meant to trust it.
- a validation error lets it open enterprise mailIn Microsoft's own code.the assumption breaks here
- Storm-0558 forges tokensEvery sign-in looks valid to the customer.
- State Department logs catch itAbout 500 people across 22 organisations. Judged preventable in 2024.
how it surfaced
A US State Department team caught the anomaly in its own audit logging and reported it to Microsoft. The investigation found that email belonging to roughly 500 individuals across about 22 organizations had been accessed. In 2024 the US Cyber Safety Review Board published its review and concluded the intrusion was preventable, describing a cascade of avoidable errors in how the key was handled and validated.
Controlling who logs in protects you only as far down as the layer you can see.
Underneath the login sits the provider’s own machinery for deciding which tokens are real, and when that machinery is wrong, a valid-looking session is the attack.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersAttackers forge their way into your email, and every login looks valid.what it costs youYou could not have caught it yourself. Someone else's audit logs found it.
- or it goes like thisit happenedMicrosoft AI data exposure, 2023howA share link meant for one folder opens the whole storage account.what leavesbackups, passwords and private messageswho ends up with itanyone who finds the link
- or it goes like thisit happenedPower Apps misconfiguration, 2021howA default on a no-code app leaves its data readable without logging in.what leavespersonal records you collectedwho ends up with itanyone who looks
sources
- Cyber Safety Review Board, "Review of the Summer 2023 Microsoft Exchange Online Intrusion" ,
- Microsoft Security, "Analysis of Storm-0558 techniques for unauthorized email access" ,
- The Hacker News, "U.S. Cyber Safety Board Slams Microsoft Over Breach by China-Based Hackers" ,
- Infosecurity Magazine, "Report Slams Microsoft Security Failures in Government Email Breach" ,
your turn
what you can do about it
this week
Confirm you actually retain and can search the sign-in and audit logs for your email tenant, far enough back to investigate a quiet stretch, because the only place an intrusion at the provider layer shows up on your side is in the record of what those trusted sessions did.
Your cloud email looks healthy this morning because every session in it is authenticated, which is exactly what a forged-token intrusion also looks like from your seat. The State Department found this in its logs, not in its login screen.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →