Microsoft AI Team Mistakenly Leaks 38TB of Company Data

In a significant security oversight, Microsoft's AI research team inadvertently exposed 38 terabytes of the company's confidential data. The breach was discovered by cloud security startup Wiz, and occurred due to an incorrectly configured link to a bucket of training data containing open-source code and AI models for image recognition.

Users accessing this repository were provided with a link from Azure, Microsoft's cloud storage service, to download the models. However, this Azure Storage URL was misconfigured and granted access to the entire storage account, thereby exposing additional private data by mistake. According to Mashable, the exposed data included full backups of two Microsoft employees' computers, sensitive personal data, passwords to various Microsoft services, and secret keys.

Wiz's report indicates that the data might have been exposed since 2020. The exposure was attributed to an Azure feature known as Shared Access Signature (SAS) tokens, which are essentially signed URLs that grant access to Azure Storage data. While they can be configured to limit access to specific files or datasets, the link provided by the AI team was set up with full access permissions.

Upon being alerted by Wiz on June 22, 2023, Microsoft took swift action, invalidating the SAS token just two days later.

Following an internal investigation completed in August, Microsoft stated that no customer data was exposed and no other internal services were compromised due to this oversight. The company further emphasized that as a result of Wiz’s findings, it has expanded GitHub’s secret spanning service to monitor for incorrectly configured SAS tokens.

Wiz co-founder and CTO Ami Luttwak highlighted the challenges faced by tech companies in the AI domain. Speaking to TechCrunch, he mentioned, "AI unlocks huge potential for tech companies. However, as data scientists and engineers race to bring new AI solutions to production, the massive amounts of data they handle require additional security checks and safeguards. With many development teams needing to manipulate massive amounts of data, share it with their peers or collaborate on public open source projects, cases like Microsoft’s are increasingly hard to monitor and avoid.”