Free tools Windows power users keep installed
One-click scans. No signup required.
Microsoft has not publicly confirmed that Russian state-sponsored hackers stole or copied its source code. In a March 8, 2024 update, the company said Midnight Blizzard had used information taken from employee email to access or attempt to access some source-code repositories and internal systems. Microsoft did not identify the repositories or say that code was exfiltrated. That account refined its January assessment, which said there was no evidence of source-code access at that time.
What Microsoft said about source-code access
Microsoft attributed the intrusion to Midnight Blizzard, a Russian state-sponsored actor also known as NOBELIUM. On March 8, 2024, Microsoft said: “This has included access to some of the company’s source code repositories and internal systems.” The company described access or attempted access, but did not publicly specify which repositories were involved, how much code was exposed, or whether any source code was copied. Microsoft’s March 8 update is the basis for the repository-access claim.
So the headline claim that hackers “stole” source code goes beyond what Microsoft’s disclosures establish. The supported description is that the attackers accessed or attempted to access some repositories. Whether they obtained or exfiltrated code has not been established in the cited public disclosures.
Why Microsoft’s account changed between January and March
| Date | What Microsoft or CISA disclosed |
|---|---|
| January 12, 2024 | Microsoft said its security team detected the attack and activated its response process. Microsoft’s initial disclosure |
| January 19, 2024 | Microsoft said the attackers had accessed some corporate email accounts and taken emails and attachments. It said it had no evidence at that point of source-code access, production-system access, customer-environment access, or AI-system access. Microsoft’s initial disclosure |
| January 25, 2024 | Microsoft published technical guidance describing the account and application weaknesses it believed were involved. Microsoft’s incident guidance |
| March 8, 2024 | Microsoft said the attackers were using information taken from email to gain, or attempt to gain, unauthorized access to some source-code repositories and internal systems. Microsoft’s update |
| March 8, 2024 | In an amended SEC filing, Microsoft said its investigation remained active, findings could evolve, and further unauthorized access might occur. It reported no material impact on operations as of the filing date. Microsoft’s amended SEC filing |
| April 11, 2024 | CISA announced Emergency Directive 24-02 regarding Midnight Blizzard’s exfiltration of federal civilian agency email correspondence through compromised Microsoft corporate email accounts. CISA’s directive |
The change is not proof that Microsoft’s first statement was false. The January disclosure described what the company’s investigation had found then; its March update reported additional findings. In the SEC filing, Microsoft cautioned that the investigation was ongoing.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →How the attackers reportedly got into Microsoft
Microsoft said the intrusion began in late November 2023 with password spraying against a legacy, non-production test-tenant account that did not have multifactor authentication (MFA). In password spraying, an attacker tries a small set of commonly used passwords against many accounts rather than repeatedly guessing passwords for one account. Microsoft said the attackers then abused a legacy test OAuth application with elevated access and used Exchange Online permissions to reach mailboxes. These details are Microsoft’s account of its investigation, not a separately verified forensic finding.
Microsoft said the attack was not caused by a vulnerability in its products or services. As the company put it in its January disclosure: “The attack was not the result of a vulnerability in Microsoft products or services.” The reported initial route instead involved an inadequately protected test account and application permissions.
#1 Best Overall
- Brilliant Display – Stunning 13.8" PixelSense touchscreen[1], with brilliant LCD display[2], unleashes luminous whites, deeper blacks and colors so richly saturated bringing vivid life into every frame – perfect for work, school, streaming and creative tasks.
- Power that lasts all day – With 20 hours of battery life[3], the new Surface Laptop powers through your entire day, so you can create, work and stream from morning to night without reaching for a charger.
- Work at the speed of your ideas – Built with the latest Qualcomm Snapdragon X2 Elite (12 Core) processors, Surface Laptop delivers fast, AI‑accelerated performance—making it the most powerful Surface laptop for everything from multitasking to demanding workloads.
- The ports you need – Charge on-the-go, transfer data fast, or create the ultimate desktop set up with two USB-C / USB4[4] ports.
- Built-in AI Companion – Work smarter, create freely, and communicate with confidence—Copilot[5] on Windows 11 is always there to help.
Microsoft also said the attackers used residential proxy infrastructure. Such infrastructure can make activity appear to originate from ordinary residential internet connections, complicating the task of distinguishing malicious logins from normal traffic. Microsoft’s January 25 guidance describes the technical elements and recommended investigation steps.
What is known—and unknown—about the impact
Employee email
Microsoft said a very small percentage of employee email accounts were accessed and that emails and attachments were taken. The company said the initial activity appeared to focus on information about Microsoft’s own operations. It did not publish a count of affected accounts in the cited disclosures.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsRank #2
- With 16 GB of memory, runs as many programs as you want without losing the execution
- The 13.5" 2256 x 1504 screen provides a great movie watching experience
- 512 GB SSD is enough to store your essential documents and files, favorite songs, movies and pictures
- 8 Hours battery run time helps you stay unwired and work longer non-stop
Source-code repositories
Microsoft reported access or attempted access to some repositories, but did not name them, quantify how much code was involved, or confirm source-code exfiltration. Do not treat “repository access” as equivalent to confirmed theft or publication of code.
Customers and Microsoft-hosted services
In March, Microsoft said it had found no evidence that its customer-facing systems hosted by Microsoft had been compromised. Separately, it said it was contacting customers if information found in email suggested shared secrets might need mitigation. These disclosures therefore do not establish a compromise of customer-facing services, but they do describe a reason some customers could receive targeted notices.
Rank #3
- A PREMIUM PERFORMANCE LAPTOP — Ready for work, school, and creativity. Built for busy days, big projects, and nonstop multitasking. Run video calls, school and work apps, 20+ browser tabs, and AI tools at the same time without slowing down.
- WITH AI BUILT IN — With a dedicated AI chip (Qualcomm Snapdragon X2 Elite), this Copilot+ PC[5] on Windows 11 helps you work smarter and faster. Prompt, create, and automate with ease - ready for even your most demanding tasks.
- A 13.8" TOUCHSCREEN YOU'LL ACTUALLY USE — Sharp colors, real detail, smooth 120Hz scrolling on the PixelSense touchscreen[1] with LCD display[2]. Tap, scroll, or pinch to zoom - whichever feels right for streaming, editing photos, or daily work.
- 20 HOURS OF BATTERY (LEAVE THE CHARGER) — Up to 20 hours of video playback[3] on a single charge. Work from a coffee shop, take it to class/work, or binge an entire season on a long flight — it'll keep up.
- THE PORTS YOU NEED — Two USB-C / USB4[4] ports for fast charging, big file transfers, or hooking up to three 4K monitors when you want a full desktop. Wi-Fi 7 keeps you online and fast wherever you are.
Operations and later developments
Microsoft reported no material operational impact as of its March 8, 2024 amended SEC filing. That is a dated statement, not a finding about all possible consequences or developments after the filing. The cited public disclosures do not establish the investigation’s final scope.
Who is Midnight Blizzard?
Microsoft identifies Midnight Blizzard as a Russia-based espionage actor and says the US and UK governments attribute the group to Russia’s Foreign Intelligence Service (SVR). Microsoft says the group targets governments, diplomatic entities, nongovernmental organizations, and IT service providers. Other security vendors use names including APT29, UNC2452, and Cozy Bear; those aliases are not necessary to identify the actor in Microsoft’s account. Microsoft’s threat-intelligence guidance provides its description and attribution.
Rank #4
- A PREMIUM PERFORMANCE LAPTOP — Ready for work, school, and creativity. Built for busy days, big projects, and nonstop multitasking. Run video calls, school and work apps, 20+ browser tabs, and AI tools at the same time without slowing down.
- WITH AI BUILT IN — With a dedicated AI chip (Qualcomm Snapdragon X2 Elite), this Copilot+ PC[5] on Windows 11 helps you work smarter and faster. Prompt, create, and automate with ease - ready for even your most demanding tasks.
- A 15" TOUCHSCREEN YOU'LL ACTUALLY USE — Sharp colors, real detail, smooth 120Hz scrolling on the PixelSense touchscreen[1] with LCD display[2]. Tap, scroll, or pinch to zoom - whichever feels right for streaming, editing photos, or daily work.
- 19 HOURS OF BATTERY (LEAVE THE CHARGER) — Up to 19 hours of video playback[3] on a single charge. Work from a coffee shop, take it to class/work, or binge an entire season on a long flight — it'll keep up.
- Two USB-C / USB4[4] ports and a microSD card reader for fast charging, big file transfers, or hooking up to three 4K monitors when you want a full desktop. Wi-Fi 7 keeps you online and fast wherever you are.
What organizations can take from the incident
Microsoft and CISA’s recommendations point to several layers of defense rather than a single product or control. The account described by Microsoft was a legacy test account, but its access and application permissions created a route to corporate mailboxes.
- Protect accounts with MFA. Require MFA for workforce accounts, including administrative and non-production accounts where supported. CISA also recommended strong passwords and MFA.
- Review privileged identities and OAuth applications. Inventory applications, check app-only permissions and consent grants, remove permissions that are no longer needed, and investigate applications with elevated or unusual access.
- Reduce permission scope. A test account or application should not retain broad access simply because it was once useful. Restrict access to the smallest set of resources and tasks required.
- Monitor identity and audit activity. Review sign-in, mailbox, application-consent, and permission-change logs for unusual access, unexpected tokens, or activity inconsistent with an account’s normal use.
- Handle sensitive information carefully. CISA cautioned against sharing unprotected sensitive information through unsecured channels. If an organization learns that credentials or shared secrets may have appeared in compromised email, it should assess and rotate them as appropriate.
A physical FIDO2 security key is one possible MFA method for compatible accounts and identity providers, but the disclosures do not say that a particular device would have prevented this incident. Organizations should check compatibility and select controls based on their systems and threat model.
Quick Recap
Best Value
- Brilliant Display – Stunning 13.8" PixelSense touchscreen[1], with brilliant LCD display[2], unleashes luminous whites, deeper blacks and colors so richly saturated bringing vivid life into every frame – perfect for work, school, streaming and creative tasks.
- Power that lasts all day – With 20 hours of battery life[3], the new Surface Laptop powers through your entire day, so you can create, work and stream from morning to night without reaching for a charger.
- Work at the speed of your ideas – Built with the latest Qualcomm Snapdragon X2 Elite (12 Core) processors, Surface Laptop delivers fast, AI‑accelerated performance—making it the most powerful Surface laptop for everything from multitasking to demanding workloads.
- The ports you need – Charge on-the-go, transfer data fast, or create the ultimate desktop set up with two USB-C / USB4[4] ports.
- Built-in AI Companion – Work smarter, create freely, and communicate with confidence—Copilot[5] on Windows 11 is always there to help.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
