Cyber review board blames cascading Microsoft failures for Chinese hack

The Cyber Safety Review Board found that the July 2023 intrusion by China-linked Storm-0558, which resulted in theft of a Microsoft signing key and unauthorized access to senior U.S. officials' email, was a preventable failure caused by cascading security lapses and a corporate culture that deprioritized security; the report also criticizes Microsoft for misstating the likely root cause and delaying corrective disclosures.