Microsoft confirmed that a misconfigured storage endpoint exposed business transaction data involving the company and prospective customers in 2022. Security firm SOCRadar reported large numbers of affected records and entities; Microsoft said its investigation found duplicates and disputed the scale. The available reporting does not establish a final count of unique people or organizations affected.
What happened in the Microsoft BlueBleed incident?
On October 19, 2022, Microsoft said an inadvertently misconfigured endpoint exposed business transaction data related to interactions between Microsoft and prospective customers. Microsoft said it corrected the issue and notified impacted customers. It described the cause as an endpoint misconfiguration—not a security vulnerability—and said the endpoint was not used across the Microsoft ecosystem. SecurityWeek’s October 20, 2022 report summarized Microsoft’s statement.
As an Amazon Associate I earn from qualifying purchases.
Microsoft said exposed information could include names, email addresses, email content, company names, phone numbers, and potentially attached files related to business between a customer and Microsoft or an authorized Microsoft partner. The disclosure concerned business interactions and prospective customers; it does not establish that every person or company whose information may have appeared was a Microsoft customer.
What numbers did SOCRadar report?
SOCRadar described six exposed cloud-storage buckets in its broader BlueBleed report. It said those buckets involved 150,000 companies across 123 countries. Within that broader set, SOCRadar identified a Microsoft Azure Blob Storage instance and reported information concerning more than 65,000 entities in 111 countries. These are SOCRadar’s reported figures, not Microsoft-confirmed counts of unique affected customers. SOCRadar’s October 2022 report describes the findings.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
SOCRadar also reported that the Microsoft data set comprised 2.4 TB of files collected between 2017 and August 2022. It said its analysis identified more than 335,000 emails, 133,000 projects, and 548,000 users. SOCRadar described materials including proof-of-execution and statement-of-work documents, user information, product orders and offers, project details, and personal information. Those categories and counts are attributed to SOCRadar.
Why did Microsoft call the figures exaggerated?
Microsoft said its analysis found duplicate information, including repeated references to the same emails, projects, and users. Its point was that SOCRadar’s record totals should not be read as equivalent numbers of distinct people or organizations. The counts also refer to different things—emails, projects, users, entities, and storage volume—so they cannot be combined into one affected-person total.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Neither the cited SOCRadar report nor Microsoft’s response provides a definitive deduplicated count of affected people or organizations. The disagreement is about the scale implied by the reported data, not whether Microsoft confirmed an exposure: Microsoft acknowledged the misconfiguration and said it took corrective action.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Does the reporting show that attackers accessed or misused the data?
The cited reporting establishes that data was exposed because of a misconfiguration. It does not establish malicious access to the storage or downstream misuse of the information. Exposure is a serious security and privacy risk, but it is not proof that an attacker obtained or exploited a particular record.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What was the dispute over SOCRadar’s lookup tool?
SOCRadar released a tool that organizations could use to check whether their information appeared in the reported buckets. Microsoft objected to the public release, saying it could create unnecessary risk for customers. Microsoft’s concern was that a public tool could let users search for data about other people or organizations; it said searches should be limited to data users are authorized to check. The cited October 2022 coverage does not establish the tool’s current availability or safety, so this article does not direct readers to it.
Quick Recap
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
