Microsoft Refused to Fix Flaw Before SolarWinds Attack

For years, an engineer at Microsoft flagged a flaw in a product that people use to log in to their devices with single sign-on. The company dismissed his warnings. One product leader told him that acknowledging the weakness could interfere with Microsoft’s business goals.
Russian hackers later took advantage of that flaw in one of the biggest cyberattacks in U.S. history, SolarWinds. They used it to compromise the National Institutes of Health, the National Nuclear Security Administration and the Department of the Treasury.
In June, Microsoft President Brad Smith testified at a congressional hearing and was grilled about what government investigators called the company’s “cascade of security failures” in another hack.
ProPublica’s Renee Dudley breaks down what happened to whistleblower Andrew Harris and what Microsoft is saying it is doing to mitigate future attacks.
To read our investigation, go to: propub.li/3L78gex
📰: Renee Dudley, with research by Doris Burke
🎨: Anuj Shrestha
🎥: Jose Sepulveda
-
ProPublica is an independent, nonprofit newsroom that produces investigative journalism with moral force.
+ Sign up for our weekly newsletter: propub.li/2oyN8DY
+ Follow us on X/Twitter: / propublica
+ Follow us on Instagram: / propublica
+ Follow us on TikTok: / propublica
+ Follow us on Facebook: / propublica
+ Follow us on Threads: www.threads.ne...
+ Follow us on Mastodon: newsie.social/...
+ Follow us on Bluesky: bsky.app/profi...

[@davidmenasco5743]

Well done.