Microsoft Alerts Customers to Prevent Data Theft from SharePoint Servers

Microsoft issued an urgent security alert Saturday about ongoing cyberattacks targeting a previously unknown flaw in SharePoint servers. The attacks affect tens of thousands of systems across government agencies, businesses, and universities in North America, Europe, and Asia.

The vulnerability allows hackers to perform network spoofing, letting them impersonate trusted sources and steal or manipulate data. Only on-premise SharePoint 2016 and 2019 installations face risk. Microsoft’s cloud-based SharePoint Online service remains unaffected.

Researchers and government officials report successful breaches at U.S. federal and state agencies, universities, energy companies, and an Asian telecommunications operator. Some victims experienced deletion or hijacking of public document repositories. Security experts worry hackers extracted cryptographic keys during these breaches, which would allow them to regain access even after patches are installed.

The attacks began within the past few days, according to Microsoft. The company released a patch Sunday evening for one server version but continues working on fixes for two other versions. Microsoft advised customers who cannot enable recommended security protections to disconnect affected servers from the internet until updates become available.

We are seeing attempts to exploit thousands of SharePoint servers globally before a patch is available, – said Pete Renals, senior manager at Palo Alto Networks’ Unit 42. – We have identified dozens of compromised organizations spanning both commercial and government sectors.

The FBI confirmed awareness of the attacks and is working with federal and private partners. The Cybersecurity and Infrastructure Security Agency coordinates response efforts with Microsoft and other agencies. CISA officials report working around-the-clock despite a 65 percent reduction in incident-response teams.

The breach represents another security challenge for Microsoft. In early 2023, Chinese-backed hackers exploited Microsoft Exchange Server vulnerabilities to steal U.S. government emails. A government and industry expert panel later criticized Microsoft for issuing narrow fixes that left similar attack routes open.