Key Lesson from Microsoft’s Password Spray Hack: Secure Every Account

In January 2024 Microsoft was breached by Russian-state APT 'Midnight Blizzard' (Nobelium) using a simple password-spray attack against a legacy inactive test account, enabling a seven‑week intrusion during which a small percentage of corporate email accounts (including senior leadership and Cybersecurity/Legal teams) had emails and attachments exfiltrated; the piece emphasizes that low‑privileged or inactive accounts are high-risk and urges stronger password policies, MFA, Active Directory audits, and compromised-password scanning.