A failed Microsoft patch is the latest win for Chinese hackers

Last year, Satya Nadella pledged to make security priority number one at Microsoft. A new hack involving China is showing just how difficult that can be.

- Robert McMillan & Dustin Volz

The attack involves several versions of Microsoft's SharePoint software that serve as a document storage platform for customers who don't want to use the cloud. Microsoft released patches for a pair of SharePoint bugs earlier this month, but the fixes were quickly bypassed, allowing Chinalinked hackers to break into hundreds of organizations, according to security researchers.

Instead of protecting customers, the faulty patches may have served as a road map for hackers to hone their attacks, the researchers said.

It's the latest in a string of lapses by the technology giant that have benefited China's vast and global cyber-espionage operations, a top U.S. national security threat.

Last year, the Department of Homeland Security released a scathing report detailing Microsoft's mistakes during a 2023 hack in which China stole thousands of emails from top government officials. Two years before that, Chinalinked cyberattackers compromised more than 250,000 Microsoft Exchange servers.

"They are too big to keep failing like this," said Jeff Greene, a former top U.S. cybersecurity official who helped write last year's withering report on Microsoft's missteps. "While I credit them for leaning into security after our report, they need to do better-and show publicly how they're doing better."

In response to last year's report, Nadella promised to rededicate Microsoft to protecting its products and its customers from bad actors, something he called the Secure Future Initiative.

'Secure Future'

"As part of our Secure Future Initiative we are committed to continual improvement in security response and remediation," said Ann Johnson, Microsoft's deputy chief information security officer. She noted that the company released its new fixes for the bugs within 72 hours of learning of the attack, directly reached out to customers, and published two blog posts on the issue.