Incident BriefingsMicrosoft security incident

Microsoft security incident

Lapsus$; single compromised employee account. Partial source code for Bing/Cortana and other products accessed.

Last modified

Summary

  • Environment: Tech
  • Operational impact: Partial source code for Bing/Cortana and other products accessed
  • Financial impact: No financial figure is established by the reviewed source evidence
  • Record status: Developing record. Reviewed September 19, 2026; updated as evidence emerges.

What happened

In 2022, Microsoft experienced an incident in its tech environment. The retained source describes the attack path as follows: Lapsus$; single compromised employee account. [1]

The documented consequence was: Partial source code for Bing/Cortana and other products accessed. [1]

Impact

  • Documented impact: Partial source code for Bing/Cortana and other products accessed. [1]
  • No financial loss, ransom amount, recovery cost, or regulatory penalty is established by the reviewed source evidence.

Timeline

  1. Documented public update

    The DEV-0537 criminal actor targeting organizations records the incident facts used in this briefing.

    [1]

  2. Briefing updated

    This briefing was last reviewed and updated on September 19, 2026.

Threat Group & Attack Vector

The retained source describes the attack path as follows: Lapsus$; single compromised employee account. The canonical record does not add intrusion steps beyond those supported by the source. [1]

Actors

  • Lapsus$ — identified in the supported attack description. [1]

TTPs

  • No specific MITRE ATT&CK technique is currently mapped for this case.

Response

The reviewed source does not describe containment, notification, or restoration steps in enough detail to summarize them responsibly.

This account is bounded to DEV-0537 criminal actor targeting organizations. Details absent from that evidence are left unresolved rather than inferred. [1]