Because of misconfigurations, basically anyone could have access to confidential support data from Microsoft customers.

Some Microsoft servers were configured unsecure, so that support data such as chat recordings were publicly available. The 250 million entries were unprotected and publicly accessible. Access would have been possible directly via a web browser. In the meantime, the data is no longer accessible now.

Comparitech security researchers came across five insecurely configured Elasticsearch servers, each of which provided the customer data. Microsoft said the data was publicly available between December 5 and December 31, 2019. After a notification, Microsoft is said to have reacted within 24 hours and to have taken care of the data leak, the security researchers write in a post. The customer data should go back to the year 2005.

The leaked entries contain, for example, email addresses, information on support cases and locations. Many of the entries are said to have been unencrypted. This information could be used by fraudsters, for example, to write credible spam emails.

In the case of Microsoft, it would also be conceivable that fraudsters could use the data. Fake support on the phone of alleged Windows support staff has been a recurring trick for years. So far it is unknown whether unauthorized persons could access the data.

It should be noted that Microsoft does not automatically address customers with technical problems. In the event of problems, the customer must always take the first step. So if you get a supposed support email or a call, it is certainly a scam. Under no circumstances should you be tempted to install remote access software on your own computer. This opens the door to attackers. In addition, Microsoft never asks for passwords.