2021 Microsoft Exchange Server data breach

A global wave of <a href="/facts/Cyberattack/6PSQzq7y">cyberattacks</a> and <a href="/facts/Data_breach/xGxRFY1A">data breaches</a> began in January 2021 after four <a href="/facts/Zero-day_(computing)/B1jJkD0C">zero-day exploits</a> were discovered in <a href="/facts/On-premises_software/yGJvghTK">on-premises</a> <a href="/facts/Microsoft_Exchange_Server/9pu8G4It">Microsoft Exchange Servers</a>, giving attackers full access to user emails and passwords on affected servers, <a href="/facts/Superuser/0Brr6ol7">administrator privileges</a> on the server, and access to connected devices on the same network. Attackers typically install a <a href="/facts/Backdoor_(computing)/4Vry8CKE">backdoor</a> that allows the attacker full access to impacted servers even if the server is later updated to no longer be vulnerable to the original exploits. As of 9 March 2021<a href="https://en.wikipedia.org/w/index.php?title=2021_Microsoft_Exchange_Server_data_breach&action=edit">[update]</a>, it was estimated that 250,000 servers fell victim to the attacks, including servers belonging to around 30,000 organizations in the United States, 7,000 servers in the United Kingdom, as well as the <a href="/facts/European_Banking_Authority/VCC2eTz5">European Banking Authority</a>, the <a href="/facts/Storting/JrDWe9Fu">Norwegian Parliament</a>, and Chile's Commission for the Financial Market (CMF).
On 2 March 2021, Microsoft released updates for <a href="/facts/History_of_Microsoft_Exchange_Server/UXsqUq44">Microsoft Exchange Server 2010, 2013, 2016 and 2019</a> to patch the exploit; this does not retroactively undo damage or remove any backdoors installed by attackers. Small and medium businesses, local institutions, and local governments are known to be the primary victims of the attack, as they often have smaller budgets to secure against cyber threats and typically outsource <a href="/facts/IT_service_management/UIpRDey0">IT services</a> to local providers that do not have the expertise to deal with cyber attacks.
On 12 March 2021, Microsoft announced the discovery of "a new family of <a href="/facts/Ransomware/muT4jcxj">ransomware</a>" being deployed to servers initially infected, <a href="/facts/Encryption/16q29Fdv">encrypting</a> all files, making the server inoperable and demanding payment to reverse the damage. On 22 March 2021, Microsoft announced that in 92% of Exchange servers the exploit has been either patched or mitigated.

2021 Microsoft Exchange Server data breach open-in-new

2021 Microsoft Exchange Server data breach