The company said it detected on January 12, 2024 that, beginning in late November 2023, a nation-state-linked threat actor had gained access to and exfiltrated information from a very small percentage of employee email accounts, including those of members of its senior leadership team and employees in its cybersecurity, legal and other functions.

1. 01

   The company said it detected on January 12, 2024 that, beginning in late November 2023, a nation-state-linked threat actor had gained access to and exfiltrated information from a very small percentage of employee email accounts, including those of members of its senior leadership team and employees in its cybersecurity, legal and other functions.

2. 02

   The company said the threat actor used a password spray attack to compromise a legacy non-production test tenant account and gain a foothold, then used that account's permissions to exfiltrate some emails and attached documents. The company said the attack was not the result of a vulnerability in Microsoft products or services.

3. 03

   The company said it removed the threat actor's access to the email accounts on or about January 13, 2024 and is notifying law enforcement and regulatory authorities of the unauthorized access to personal information. As of the filing date, the incident has not had a material impact on its operations, but the company said it has not yet determined whether the incident is reasonably likely to materially affect its financial condition or results of operations.

4. 04

   The company said it has seen no evidence to date that the threat actor accessed customer environments, production systems, source code or AI systems. It also said it will act immediately to apply its current security standards to Microsoft-owned legacy systems and internal business processes, even if this causes disruption to existing business processes.

Analysis scope · Filing body and confirmed press-release exhibitWe analyzed the filing body and confirmed exhibits. This is not a review of other exhibits, investor presentations or the full earnings call.

AI summarized the filing and translated the summary into English; it may differ from the original. For reference only, not investment advice. AI translated the published Korean report into English. Figures are copied as filed, not recalculated.

Original filing

The filing as submitted to SEC EDGAR. You can check the figures and statements of this summary against it.