At Least 30,000 U.S. Organizations Newly Hacked Via Holes in Microsoft’s Email Software
Summary: At least 30,000 U.S. organizations, including small businesses, towns, cities and local governments, have been hacked over a few days by a Chinese cyber espionage unit exploiting four newly-discovered flaws in Microsoft Exchange Server email software. Microsoft released emergency updates on March 2 for Exchange Server 2013 through 2019, and the group it dubbed Hafnium has left web shells giving administrative access on victim servers, with experts telling KrebsOnSecurity the group has seized control of hundreds of thousands of Exchange Servers worldwide.
Key Takeaway: Patching only closes the four entry points and does nothing to remove a web shell already planted, so organizations that patched on the day Microsoft published still face a high chance of existing compromise. With thousands of servers compromised per hour globally and not enough incident response teams to go around, state and local agencies are already calling for help they cannot quickly get.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026