European Banking Authority hit by global Microsoft hack
The European Banking Authority (EBA), a key EU financial regulator, has revealed that it has fallen victim to a suspected Chinese state-backed hack of its Microsoft email system.
The EBA said personal data may have been accessed from its servers as part of the attack. It has since taken its entire email system offline while it investigates.
An EBA spokesman said on Monday that the organisation had not yet detected any signs of data being stolen.
It comes after Microsoft revealed last week that a state-sponsored group operating out of China was exploiting previously unknown security flaws in its Exchange email services to steal data from business and government users.
There are fears that as many as 60,000 organisations around the world may have been hacked as a result of the breach. The scale of the incident has led to comparisons to the SolarWinds breach which saw Russian hackers break into a number of US government agencies.
“The agency has swiftly launched a full investigation, in close cooperation with its ICT provider, a team of forensic experts and other relevant entities,” an EBA spokesman said.
Microsoft blamed the hacking campaign on a “highly skilled and sophisticated actor” dubbed Hafnium which it said had links to the Chinese government.
Hafnium has in the past targeted US-based companies including infectious disease researchers, law firms, universities, defence contractors, think tanks, and NGOs.
The UK’s National Cyber Security Centre, a division of intelligence agency GCHQ, is understood to be investigating the potential UK impact of the Microsoft Exchange hack.
A spokesman for Microsoft declined to comment when asked if the company is in contact with organisations in the UK about the hack.
“We are working closely with the CISA, other government agencies, and security companies, to ensure we are providing the best possible guidance and mitigation for our customers,” he said. “The best protection is to apply updates as soon as possible across all impacted systems.”
Beijing typically rejects US hacking charges out of hand and last year berated Washington following allegations that Chinese hackers were attempting to steal coronavirus research.
