web search

A U.S. senator, Ron Wyden, has requested an investigation by the Federal Trade Commission (FTC) into Microsoft's role in a ransomware attack on Ascension Health, alleging "gross cybersecurity negligence." The attack, which occurred in 2024, involved hackers using a method called "Kerberoasting" to exploit Microsoft’s Active Directory server, taking advantage of the outdated RC4 encryption standard. Wyden criticized Microsoft for not making the more secure Advanced Encryption Standard (AES) the default option in Windows and for failing to adequately warn customers about vulnerabilities related to Kerberoasting. Microsoft acknowledged that RC4 is outdated but stated that disabling it could disrupt customer systems. The company plans to disable RC4 by default in new installations of Active Directory Domains using Windows Server 2025 by early 2026. Wyden noted that the ransomware attack originated from a malicious link clicked by a contractor while using Microsoft’s Bing, leading to malware installation and subsequent ransomware deployment across Ascension’s systems. The attack severely impacted Ascension's operations, forcing its 140 hospitals to revert to manual processes for weeks and compromising sensitive data of nearly 6 million individuals. Patients in Texas, Illinois, and Tennessee have filed class action lawsuits against Ascension due to the breach. The Black Basta ransomware gang has been implicated in the attack, although they have not claimed responsibility.