In a bold move that echoes prior concerns over cybersecurity, Senator Ron Wyden has called upon the Federal Trade Commission to open an investigation into Microsoft. This request comes in response to the tech giant's role in the ransomware attack on Ascension, a significant U.S. hospital system, in 2024. Millions of patient records were compromised, and Wyden's concern is that Microsoft's software contributed heavily to the breach.
Senator Wyden’s request highlights Microsoft’s shortcomings in cybersecurity. “I urge the FTC to investigate Microsoft and hold the company responsible for the serious harm it has caused by delivering dangerous, insecure software to the U.S. government and to critical infrastructure entities, such as those in the U.S. health care sector,” Wyden said, according to wyden.senate.gov. This isn't Wyden's first time raising the alarm; in July 2023, he addressed a major Chinese hack of government agencies, which also involved Microsoft's software inadequacies.
The catalyst for the Ascension data breach was traced back to a contractor infected with malware through a link found on Microsoft's Bing. The hackers deployed a technique called "Kerberoasting" to exploit outdated and insecure encryption technology known as "RC4," still supported by Microsoft software. Despite warnings from Wyden's staff and Microsoft's own acknowledgement of the issue in a blog post dated October 11, 2024, the pledged software update to mitigate such vulnerabilities has yet to be released, nearly a year later.
Wyden has been vocal for years on the perils of Microsoft's software security practices. According to wyden.senate.gov press release, after calling for accountability in 2023, the Cyber Safety Review Board reviewed the Chinese hack incident and found Microsoft wanting: "Microsoft’s security culture was inadequate and requires an overhaul." Wyden's current push for an FTC investigation is informed by these past occurrences and the apparent inertia from Microsoft in addressing known security flaws.
The ramifications of Microsoft's actions, or lack thereof, weave a narrative of continued cybersecurity threats to U.S. infrastructure. Wyden's letter to the FTC chairman, Andrew Ferguson, which was made public on his website, aims to serve as a catalyst for change. The enduring question remains whether this intervention will prompt the needed scrutiny and reform of a tech behemoth deeply ingrained in the U.S.'s digital landscape.
.jpeg){kind=link}