Microsoft Confirms Hackers Accessed Its Source Code

Microsoft has announced that hackers behind the SolarWinds compromise have been able to access its source code. The announcement was released on Thursday on a blog post.

Microsoft confirms it was hacked

On Thursday this week, Microsoft confirmed that it appears their security has been compromised after it turned up some irregularities with a "small number of internal accounts". One of the accounts, Microsoft report, "hard been used to view source code in a number of source code repositories".

Microsoft's announcement adds weight to the ever-growing concern of the extent of the comprises associated with the SolarWinds hack. This hack used the Texas-based company's network monitoring software as a springboard to break into the sensitive US Government's networks and other high-profile tech companies, like Microsoft.

Microsoft has previously reported that, like other tech firms in the US, it had found malicious versions of SolarWind's software inside its network. News that its source code has been accessed, however, is new.

RELATED: MICROSOFT WINDOWS 95 TECH INNOVATOR ERIC ENGSTROM DIES AT 55

This is obviously worrying for Microsoft, and its customers, as the source code is the underlying set of instructions that run a piece of software, or operating system. For this reason, a source code of this nature is typically a closely guarded, and protected, secret.

To date, it is not clear which source code, and how much of it, within their repositories the hackers were able to access and view. Microsoft has also declined to elaborate on the post -- according to the New York Post.

An investigation is ongoing

Microsoft has indicated that the hacked account did not have the ability to actually modify the source code, however.

"Our investigation has, however, revealed attempted activities beyond just the presence of malicious SolarWinds code in our environment. This activity has not put at risk the security of our services or any customer data, but we want to be transparent and share what we’re learning as we combat what we believe is a very sophisticated nation-state actor," reported Microsoft. 

The official announcement has also indicated that they have not found any evidence of access "to production services or customer data.”

But, there is some good news. According to the official disclosure, while evidence was found of some attempted nefarious activities, its existing "defense-in-depth protections" did manage to thwart it. 

“The investigation, which is ongoing, has also found no indications that our systems were used to attack others,” Microsoft added.

Microsoft also attempted to reassure its customers that they will continue to investigate and improve its security systems, where applicable.

"We will provide additional updates if and when we discover new information to help inform and enable the community. As we learn more from our own internal investigation, and from helping customers, we will continue to improve our security products and share these learnings with the community," said Microsoft.