Case microsoft-ai-38tb-sas-token-exposureModel & data leakUnited States
Microsoft AI researchers expose 38TB of data via misconfigured SAS token
Wiz Research found Microsoft's AI GitHub repository exposed 38TB of data, including over 30,000 internal Teams messages, because of one misconfigured SAS token.
HighAttack on AIStatus: ResolvedVerified case file
Open in the interactive mapCite this case
- Reported
- Sep 18, 2023
- Location
- United States
- Target
- Microsoft AI GitHub repository
- Severity
- High
- Triggered by
- Microsoft AI researchers (accidental exposure)
- Actor type
- Accidental / misconfiguration
- Reported loss
- None reported
- CVE
- None
What happened
Wiz Research found Microsoft's AI GitHub repository exposed 38TB of data, including over 30,000 internal Teams messages, because of one misconfigured SAS token.
Impact: 38TB of data exposed, including over 30,000 internal Microsoft Teams messages.
Who triggered it
Actor: Microsoft AI researchers (accidental exposure)
Attribution: Found by Wiz Research; the summary describes an accidental misconfiguration, not an attacker.
Motive: None; accidental exposure
How it happened
Attack vector: Misconfigured Azure SAS token tied to Microsoft's AI GitHub repository
Root cause: A single misconfigured SAS token granted access to far more data than intended.
Timeline
- Reported by Wiz Research
Response
Unknown
Current status: Resolved
Sources (open in a new tab)
- Wiz Research wiz.io
Cite this case
Microsoft AI researchers expose 38TB of data via misconfigured SAS token. AI Threat Watch, case microsoft-ai-38tb-sas-token-exposure, Sep 18, 2023. https://aithreat.io/cases/microsoft-ai-38tb-sas-token-exposure/
Permanent link: https://aithreat.io/cases/microsoft-ai-38tb-sas-token-exposure/