It was late February, and Microsoft Corp. engineers had been working for weeks on a handful of alarming weaknesses in the company’s popular Exchange email service. They were rushing to send out a fix, targeting the second Tuesday of March — part of a monthly ritual known in cybersecurity circles as “patch Tuesday.”
The hackers got a head start. Following weeks of discreet attacks, Chinese hackers shifted into high gear. The result was a sprawling campaign that engulfed thousands of organizations in a matter of days.
Something had gone wrong. What is normally a relatively smooth process — the one Microsoft uses regularly for identifying and fixing weaknesses in its popular software — has morphed into a global cybersecurity crisis now consuming the attention of the White House.
In all, researchers had identified four vulnerabilities and classified them as critical, meaning hackers can use them unseen to steal emails and other data.
But on Feb. 26, before the software giant released its patches, attackers began infiltrating those email systems en masse — almost as though they knew their window of opportunity was about to close, said Ryan Kalember, executive vice president of cybersecurity strategy at the email security firm, Proofpoint Inc.
In a time of both misinformation and too much information, quality journalism is more crucial than ever.
By subscribing, you can help us get the story right.
With your current subscription plan you can comment on stories. However, before writing your first comment, please create a display name in the Profile section of your subscriber account page.