Microsoft corporate inboxes breached. 23andMe confirms raw genotype data leaked. Pwn2Own Automotive results.

Microsoft hasn't had a stellar few months when it comes to security. This time they were compromised by a Russian state-sponsored hacking group known as Midnight Blizzard. They breached a "non-production test tenant account", and somehow pivoted from there to extracting emails and attachments from top-level executives and cybersecurity employees.

Microsoft responded themselves in this blogpost, where they seem to downplay this a little too much. For example, they state that "only a very small percentage of our corporate inboxes were breached". Yeah, at the size of a company like Microsoft, breaching only the executives and cybersecurity teams won't be a high percentage number. But we're not assessing quantity here, are we. They also don't provide information on how the attackers went from a test tenant to corporate email inboxes.

They do state that this breach forces them to accelerate their security priorities, even saying that this might impact business processes while the shift is being made.

My favorite genetic analysis company now confirms that the attackers stole raw genotype data and health reports, and that the attack went unnoticed for five months.

Escape's security team scanned nearly 200 million URL's and found more than 18,000 exposed API secrets, and $20 million in Stripe tokens. The report is well worth a read, going deep into their methodology, the development of their web spider, the cost of the process, and of course their findings. Nice work! (Sponsored)

Good stuff! As the article points out though, do be mindful of the fact that this means that your iCloud account has to be properly secured, since you're shifting the security responsibility there.

Democratic voters in New Hampshire were flooded with robocalls using the AI-generated voice of Joe Biden urging them not to vote in the primary. The calls were also spoofed to make it seem like they were made by the former Democratic state party chair.

Always interesting to read the results of these. From what I can tell, the Synacktiv Team did a remarkable job, taking $295,000 in price money just on day one, with more the days after. I haven't seen a full wrap-up yet, but you can see the results of each day on ZDI's blog.

For the technical deep-divers among us: I came across this gem last week where someone documents the use of a Perl OAuth2 module. It explains very well, and yet casually, how the OAuth flows work, I just really liked reading through it :-)

I'm not going to write a long marketing-heavy paragraph on this one. I just love using 1Password. The UX, the support, the integrations, it all works wonderfully. Highly recommended. (Sponsored)