Microsoft on major Outlook and OneDrive outages: We were hacked

Frank Bajak

The Associated Press

In early June, sporadic but serious service disruptions plagued Microsoft&#8217;s flagship office suite — including the Outlook email and OneDrive file-sharing apps — and cloud computing platform. A shadowy hacktivist group claimed responsibility, saying it flooded the sites with junk traffic in distributed denial-of-service attacks.<div class="paywall-selector"></div><div class="paywall">



Initially reticent to name the cause, Microsoft has now disclosed that DDoS attacks by the murky upstart were indeed to blame.



But the software giant has offered few details — and did not immediately comment on how many customers were affected and whether the impact was global. A spokeswoman confirmed that the group that calls itself Anonymous Sudan was behind the attacks. It claimed responsibility on its Telegram social media channel at the time. Some&nbsp;<a href="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/anonymous-sudan-religious-hacktivists-or-russian-front-group/">security researchers</a>&nbsp;believe the group to be Russian.



Microsoft’s explanation in a&nbsp;<a href="https://msrc.microsoft.com/blog/2023/06/microsoft-response-to-layer-7-distributed-denial-of-service-ddos-attacks/">blog post Friday evening</a>&nbsp;followed a request by The Associated Press two days earlier. Slim on details, the post said the attacks “temporarily impacted availability” of some services. It said the attackers were focused on “disruption and publicity” and likely used rented cloud infrastructure and virtual private networks to bombard Microsoft servers from so-called botnets of zombie computers around the globe.



Microsoft said there was no evidence any customer data was accessed or compromised.



While DDoS attacks are mainly a nuisance — making websites unreachable without penetrating them — security experts say they can disrupt the work of millions if they successfully interrupt the services of a software service giant like Microsoft on which so much global commerce depends.



It&#8217;s not clear if that&#8217;s what happened here.



“We really have no way to measure the impact if Microsoft doesn’t provide that info,” said Jake Williams, a prominent cybersecurity researcher and a former National Security Agency offensive hacker. Williams said he was not aware of Outlook previously being attacked at this scale.



“We know some resources were inaccessible for some, but not others. This often happens with DDoS of globally distributed systems,” Williams added. He said Microsoft&#8217;s apparent unwillingness to provide an objective measure of customer impact “probably speaks to the magnitude.”



Microsoft dubbed the attackers Storm-1359, using a&nbsp;<a href="https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide">designator it assigns to groups</a>&nbsp;whose affiliation it has not yet established. Cybersecurity sleuthing tends to take time — and even then can be a challenge if the adversary is skilled.



Pro-Russian hacking groups including Killnet — which the cybersecurity firm Mandiant says is Kremlin-affiliated — have been bombarding government and other websites of Ukraine&#8217;s allies with DDoS attacks.&nbsp;<a href="https://apnews.com/article/technology-business-atlanta-680cf93f7eb0300127448c35299ad66e">In October</a>, some U.S. airport sites were hit. Analyst Alexander Leslie of the cybersecurity firm Recorded Future said it&#8217;s unlikely Anonymous Sudan is located as it claims in Sudan, an African country. The group works closely with Killnet and other pro-Kremlin groups to spread pro-Russian propaganda and disinformation, he said.



Edward Amoroso, NYU professor and CEO of TAG Cyber, said the Microsoft incident highlights how DDoS attacks remain “a significant risk that we all just agree to avoid talking about. It’s not controversial to call this an unsolved problem.”



He said Microsoft&#8217;s difficulties fending of this particular attack suggest “a single point of failure.” The best defense against these attacks is to distribute a service massively, on a content distribution network for example.



Indeed, the techniques the attackers used are not old, said U.K. security researcher Kevin Beaumont. “One dates back to&nbsp;<a>2009</a>,” he said.



<a href="https://apnews.com/article/outlook-microsoft-outage-down-ee5430f6a4636b297c64f0c0b695cfc3">Serious impacts</a>&nbsp;from the Microsoft 365 office suite interruptions were reported on Monday June 5, peaking at 18,000 outage and problem reports on the tracker Downdetector shortly after 11 a.m. Eastern time.



On Twitter that day,&nbsp;<a href="https://twitter.com/MSFT365Status/status/1665744417783775232?s=20">Microsoft said</a>&nbsp;Outlook, Microsoft Teams, SharePoint Online and OneDrive for Business were affected.



Attacks continued through the week, with Microsoft confirming on June 9 that its Azure&nbsp;<a href="https://twitter.com/azuresupport/status/1667206178210816002?s=46">cloud computing platform</a>&nbsp;had been affected.



On June 8, the computer security news site BleepingComputer.com&nbsp;<a href="https://twitter.com/BleepinComputer/status/1666873449908776961?s=20">reported</a>&nbsp;that cloud-based OneDrive file-hosting was down globally for a time.



Microsoft said at the time that desktop OneDrive clients were not affected, BleepingComputer reported.</div>

The Anonymous Sudan group, which may be Russian, was behind the hack.

Microsoft confirms hacking of Outlook, OneDrive in June

F-Wire

Cybersecurity

Tech

A spokeswoman confirmed that Anonymous Sudan, which some believe to be a Russian group and claimed responsibility at the time, was in fact the hacker.

Microsoft confirms hacking of Outlook, OneDrive in June | Fortune Europe

Ryan Hogg

Dominik Asam, Chief Financial Officer at SAP, will be speaking on stage at the Digital Life Design (DLD) innovation conference at the House of Communication in Munich (Bavaria) on January 17, 2025. DLD is a conference on internet trends and developments in digitalization.

CFO of SAP, Europe’s most valuable company, hopes trade war is a ‘wake-up call’ for the continent

/europe/2025/04/24/cfo-sap-europes-most-valuable-company-hopes-trade-war-wake-up-call-continent/

Nokia blames tariff wars and shifting global trade landscape as cause of profit decline

/europe/2025/04/24/nokia-tariff-wars-global-trade-profits-decline/

Raziye Akkoc

Apple and Meta hit with over $750 million in fines for violating Europe’s digital rules—escalating tension between the bloc and Trump

/europe/2025/04/23/apple-meta-hit-with-over-750-million-fines-combined-violating-europe-digital-competition-rules-tension-trump/

Christina Kyriasoglou

Bloomberg

SAP soars most in six years after profit beats estimates

/europe/2025/04/23/sap-soars-profits-most-in-six-years-europe-most-valuable-company-cloud/

European users’ public content and conversations will be used by Meta to train its AI models

/europe/2025/04/17/european-users-public-content-facebook-instagram-threads-conversations-meta-ai-models/

European Union gets serious as bloc seeks independence from U.S. tech such as Uber, Apple and Mastercard

/europe/2025/04/16/europe-independence-us-tech-trump-meta-apple-uber-mastercard/

Fortune Editors

Fortune Europe provides smart and timely business news in European markets.

Uncategorized

homepage

Fortune Europe

Finance

Lifestyle

Retail

Stuart Dyos

Execs at Ray Dalio’s hedge fund say we’re in a ‘once-in-a-generation’ economic shift that ‘threatens the existing world order’

https://fortune.com/article/ray-dalio-hedge-fund-bridgewater-associates-economic-shift-us-stocks-donald-trump-world-order-economy/?itm_source=parsely-api

Dave Smith

The Vatican asked Pope Francis funeral attendees to wear all black. Trump wore a blue suit

https://fortune.com/article/pope-francis-funeral-dress-code-donald-trump-blue-suit/?itm_source=parsely-api

Emma Burleigh

CEO of $65 billion software giant Workday's warning: 'There's nothing more dangerous than yesterday's success'

https://fortune.com/article/workday-ceo-carl-eschenbach-career-advice-dangerous-success-failure/?itm_source=parsely-api

Jeremy Kahn

ServiceNow's CEO says company is capitalizing on economic upheaval—and projects revenue growth of more than 18% this year

https://fortune.com/article/servicenow-bill-mcdermott-earnings-beat-outlook/?itm_source=parsely-api

Irina Ivanova

Consumers are so stressed by the economy they're doing less laundry to save on detergent

https://fortune.com/article/consumers-laundry-detergent-costs/?itm_source=parsely-api

Ben Stupples

British brothers worth $9 billion quit U.K. as wealth exodus grows

https://fortune.com/europe/2025/04/24/british-brothers-worth-9-billion-quit-uk-ian-richard-livingstone-wealth-exodus/?itm_source=parsely-api