Microsoft Faces Criticism Over Data Breach Notification Emails

Microsoft recently began notifying some customers via email about a potential data breach that might have compromised their personal information. However, the company’s approach has faced heavy criticism, with many saying the emails resembled spam or phishing attempts.

Cybersecurity researcher and former Microsoft employee Kevin Beaumont addressed the issue on LinkedIn, reassuring followers that the emails were legitimate, though poorly executed:

“Microsoft experienced a breach by Russia affecting customer data but did not follow the Microsoft 365 customer data breach protocol. Instead of using the portal, they emailed tenant admins,” Beaumont explained. “These emails can end up in spam, and tenant admin accounts are meant to be secure, breakglass accounts without email. They also failed to notify organizations via account managers. You should review all emails dating back to June. This is a widespread issue.”

One major concern noted by TechCrunch was the inclusion of a “secure link” in the emails, which directed recipients to a domain that did not seem related to Microsoft: “purviewcustomer.powerappsportals.com.”

“Essentially, the critical alert looks like a phishing attack,” one recipient commented on X. Many recipients shared this sentiment, as the link was submitted to urlscan.io over a hundred times. URL Scan is a service used to determine

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.