FEDERALItem 1.05 · mandatoryHackingTechnologyInformationSoftwareStolen CredentialsCapture App DataMidnight BlizzardActor NamedNation State SuspectedData ExfiltratedEmployee Data InvolvedTargetedDelayed DiscoveryOtherLowContained

MICROSOFT CORPORATION

bd_d660c617b3363d6d · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 12, 2024

Filed

Jan 19, 2024

To disclose

7 days

Affected

Not disclosed

Linked

2 filings

Confidence

88%

Full breach record for MICROSOFT CORPORATION →2 incidents on file

Microsoft disclosed via SEC Form 8-K Item 1.05 that on January 12, 2024 it detected a nation-state associated threat actor (Midnight Blizzard) had, beginning in late November 2023, gained access to and exfiltrated information from a very small percentage of employee email accounts, including senior leadership and staff in cybersecurity and legal functions. Access was removed on or about January 13, 2024. The incident had no material operational impact as of the filing date.

J jump to incidentP pin to compareR raw source

SEC clockMateriality determined Jan 17, 2024 → Filed Jan 19, 20242d ✓ SEC 4-day OK7 days discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 72 days

discovery → filing · 7 days

Nov 1, 2023

Begins

Jan 12, 2024

Discovered

Jan 17, 2024

Scope determined

Jan 19, 2024

Filed

vs. sector median

10 wks faster

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

SEC 8-KMidnight Blizzardbd_bfb10eaec0a6e1002024-03-08 · +49dCandidate

Name: MICROSOFT CORPORATION
norm: microsoft
SEC CIK: 0000789019
Domain: microsoft.com

Name: MICROSOFT CORPORATION
norm: microsoft
SEC CIK: 0000789019
Domain: microsoft.com
Industry: Technologyllm
NAICS 513210 · Software Publishers

Discovered: Jan 12, 2024
Breach occurred: Nov 1, 2023
Undetected for: 72 daysoccurrence → discovery
Materiality determined: Jan 17, 2024
Notification sent: —
Affected individuals: Not disclosed
Data types: Other
Attack vector: Unauthorized Access· Midnight Blizzard
MITRE ATT&CK: T1078 Valid AccountsT1114 Email CollectionT1041 Exfiltration Over C2 Channel
Threat actor: Midnight BlizzardExternalEspionage
Regulator citations: Notifying relevant regulatory authorities with respect to unauthorized access to personal informationFiled SEC Form 8-K under Item 1.05
Initial access: valid_credentials

During the incident: Removed the threat actor's access to the email accounts on or about January 13, 2024
Notified and are working with law enforcement
Notifying relevant regulatory authorities with respect to unauthorized access to personal information
Examining the information accessed to determine the impact of the incident
Continuing to investigate the extent of the incident
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 days(7 days from discovery to filing)
Compliance flags: SEC 4-day OK · 2d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
SEC
Materiality determined: Jan 17, 2024
→ Filed: Jan 19, 2024
2d cal. 4 business days SEC 4-day OK

Statute	Window	Elapsed	Threshold	Status
SEC	Materiality determined: Jan 17, 2024 → Filed: Jan 19, 2024	2d cal.	4 business days	SEC 4-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

SEC 8-KJan 19 · first · this page

SEC 8-K+49d

Pattern: first filing Jan 19, last Mar 8 — a 49-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statementThis record

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.sec.gov/Archives/edgar/data/789019/000119312524011295/d708866d8k.htm
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Jan 19, 2024
Raw hash: 9e47379ea22d69508a44b4183a4b0589002ad99696b24382029ea8859a7aa933

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html28.3 KB

Download View at source

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityMICROSOFT CORPORATION

Victim entityMICROSOFT CORPORATION

Incidentdiscovered Jan 12, 2024

Stated responseRemoved the threat actor's access to the email accounts on or about January 13, 2024

ComplianceSEC 4-day OK

Extraction provenanceno artifact recorded

Source provenancewww.sec.gov

Source filing