Microsoft on Wednesday announced plans to inform users when it believes that their accounts have been targeted or compromised by actors working on behalf of a nation state.
The Redmond-based technology giant has become the latest tech company to start informing users on suspected state-sponsored attacks, after Google, Facebook, and Yahoo! announced similar plans. Earlier this month, Twitter also informed some users of attacks believed to be state-sponsored, but hasn’t formally announced intentions to continue doing so.
Scott Charney, Corporate Vice President, Trustworthy Computing at Microsoft, explains in a blog post that the tech giant is already working on identifying and preventing unauthorized access to Microsoft accounts, including Outlook.com and OneDrive. The company is already notifying users when it believes their accounts might have been compromised by a third party, while also guiding them on how to keep their accounts secure.
The new measure, however, is meant specifically for those situations when the company has evidence that the attacker might be state-sponsored. According to Charney, such attacks are usually more sophisticated or more sustained when compared to attacks performed by cybercriminals and other parties.
He also explains that these notifications do not mean that Microsoft’s own systems have been compromised, nor that the accounts have been necessarily compromised. However, it does mean that the company has evidence that the accounts have been targeted and that users should take additional steps to ensure that their accounts are kept secure.
At the same time, users are advised to check their computers and other devices to ensure that they haven’t been compromised by means of viruses or other type of malware. Moreover, they should make sure that all of their software is up to date.
According to Charney, users can take various steps to ensure their Microsoft accounts and their online personal information is secure, such as two-step verification, which means that the service will automatically ask for an extra security code when an attacker tries to access the account by guessing the password.
Users are also advised to use a strong password that contains a mix of letters, numbers and symbols, and change it often, as well as to watch their accounts for any suspicious activity by accessing the “Recent Activity” page. They should also be careful of suspicious emails and websites, which might contain malware, and should always keep their computer software, especially an anti-virus program, up to date and running.