EU banking regulator hit by Microsoft email hack

The European Banking Authority (EBA), a key EU financial regulator, says it has fallen victim to a hack of its Microsoft email system which the US company blames on a Chinese group.

Microsoft said last week that a state-sponsored group operating out of China was exploiting previously unknown security flaws in its Exchange email services to steal data from business and government users, believed to number in the tens of thousands so far.

The “Hafnium” group was a “highly skilled and sophisticated actor”, it said.

Hafnium has previously targeted US-based companies including infectious disease researchers, law firms, universities, defence contractors, think tanks and NGOs, it added.

In a statement issued late Sunday, the EBA confirmed the attack on its email systems which it had decided to take offline “as a precautionary measure”.

“The agency has swiftly launched a full investigation, in close cooperation with its ICT provider, a team of forensic experts and other relevant entities,” it said.

The EBA warned that as a result of the attack, personal data could have been accessed and it would provide advice on possible mitigation measures if necessary.

Microsoft executive Tom Burt said last Tuesday that the company provided updates to fix the security flaws and urged customers to apply them.

“We know that many nation-state actors and criminal groups will move quickly to take advantage of any unpatched systems,” he added.

Beijing typically rejects US hacking charges out of hand and last year berated Washington following allegations that Chinese hackers were attempting to steal coronavirus research.

In January, the US said Russia was probably behind the massive SolarWinds hack that hit large swathes of the government and private sectors, and which experts say may constitute an ongoing threat.

Microsoft said Tuesday the Hafnium attacks “were in no way connected to the separate SolarWinds-related attacks.”