Wyden calls on FTC to investigate Microsoft for ‘gross cybersecurity negligence’ in protecting critical infrastructure

Sen. Ron Wyden urged the FTC to investigate Microsoft after the 2024 ransomware attack on Ascension hospitals exposed personal, medical, payment and government ID data for over 5.6 million patients; the attackers used Kerberoasting against Active Directory that took advantage of continued RC4 support in Microsoft defaults, and Wyden argues Microsoft’s default configurations need to change while Microsoft says it will phase out RC4 and disable it by default in Active Directory starting Q1 2026.