"US Cyber Safety Review Board Condemns Microsoft's Security Failures in Chinese Email Hack"

The U.S. Department of Homeland Security released the Cyber Safety Review Board’s findings and recommendations following its independent review of the Summer 2023 Microsoft Exchange Online intrusion, attributing it to a hacking group affiliated with the People’s Republic of China. The report detailed operational and strategic decisions that led to the intrusion and recommended specific practices for industry and government to implement to prevent similar incidents. The Board's recommendations include implementing modern control mechanisms, adopting minimum standards for default audit logging, and developing more effective victim notification and support mechanisms. The Department of Homeland Security and the Cyber Safety Review Board are committed to transparency and will release public versions of the reports whenever possible.