US senator demands investigation into Microsoft over cyberattack

Outdated encryption blamed for hospital hack

US lawmaker Ron Wyden has called for a federal investigation into Microsoft, accusing the company of creating conditions that allowed hackers to paralyse one of the nation's largest hospital networks.

Wyden, a Democrat senator from Oregon, said Microsoft's "dangerous, insecure software" was central to the ransomware attack against Ascension, a Catholic nonprofit that runs more than 140 hospitals across the country. The May 2024 breach forced doctors and nurses to revert to pen and paper, disrupted surgeries, and exposed the personal information of about 5.6 million patients.

In a lettersent on 10th September to Federal Trade Commission (FTC) chair Andrew Ferguson, Wyden outlined how the incident began when a contractor using an Ascension laptop clicked on a malicious Bing search result. Malware was installed, and attackers then moved across the network by exploiting weaknesses in Microsoft's default configurations.

Broken promises and security failures

Wyden identified a long-standing flaw known as Kerberoasting as a key factor in the attack.

“The hackers exploited a technique called Kerberoasting to gain access to privileged accounts on Ascension’s Microsoft Active Directory server. This hacking technique leverages Microsoft’s continued support by default for an insecure encryption technology from the 1980s called RC4 that federal agencies and cybersecurity experts, including experts working for Microsoft, have for more than a decade warned is dangerous,” he wrote.

According to Wyden, Microsoft promised to disable RC4 by default nearly a year ago but has not delivered the update. He argued the company has downplayed the risk by hiding guidance in obscure blogs and leaving customers exposed.

As reported by Bloomberg, Microsoft spokesperson David Cuddy defended the firm's position, stating that RC4 is an 'old standard' that now represents less than 0.1% of traffic.

In the report, Cuddy was also quoted as saying, "We're on a path to gradually reduce the extent to which customers can use it, while providing strong warnings against it and advice for using it in the safest ways possible." Cuddy further explained that the company is working to gradually decrease how much customers use RC4 and intends to fully disable it in the future.

Wyden's latest criticisms add to the pressure already staring the company in the face. A report by the US Cyber Safety Review Board (CSRB) labelled Microsoft's security culture "inadequate" after Chinese hackers stole US government emails through its cloud services in 2023. More recently, we reported how flaws in SharePoint were exploited to compromise more than 400 organisations, including the US National Nuclear Security Administration.

The Ascension incident also brings to light the growing threat to healthcare infrastructure from cyberattacks targeting hospital systems, which have become increasingly attractive targets for ransomware groups due to their critical nature and valuable patient data.

Wyden, a fierce critic of Microsoft’s security provisions, warned that without regulatory action, Microsoft's market dominance and security lapses "pose a serious national security threat and make additional hacks inevitable." The FTC is yet to comment on whether it will open an investigation at the time of this report.