Microsoft's Indian online store hacked, passwords and user data exposed

By Lee Kaelin on February 13, 2012, 8:54 AM

Microsoft’s online retail store for India, operated by Indian company Quasar Media, remains offline today after hackers breached the website's defenses and stole user account information and passwords over the weekend. Chinese hacker group Evil Shadow Team claimed responsibility for the attack, and said they found account information and passwords stored in plain text files unencrypted on the server.

"Microsoft is investigating a limited compromise of the company's online store in India," a company spokeswoman said in an emailed statement to Reuters. Store customers have already been sent guidance on the issue and suggested immediate actions as Microsoft works to secure and bring the site back online.

Although the hackers held back from releasing all of the information, they did publish proof, including a screenshot of the personal details they found. Customers' financial information has not been exposed.

Quasar Media released a brief statement saying they are not sure when the site will be up again or what happened. It is not clear exactly what the motives were for the targeting Microsoft’s Indian website, but it is thought that the border disputes between China and Pakistan and the animosity between the countries played a part, as they have all suffered attacks at the hands of hackers. 

Those with accounts at Microsoft’s online retail store for India should immediately change passwords for other online services using the same login credentials.




User Comments: 10

Got something to say? Post a comment
ikesmasher said:

posting that picture is really not necessary, is it?

Burty117 Burty117, TechSpot Chancellor, said:

Well it kinda is, all those users should be changing their passwords anyway and the site is currently down.

All that data was un-encrypted, if Microsoft had been doing its job properly the data wouldn't have ended up on here in the first place.

All users would have had some kind of email sent to them to warn them, if the user doesn't do anything, more fool them?

Guest said:

Actually it is, because it shows that microsoft keeps unencrypted user passwords.

Guest said:

Microsoft's online retail store for India, operated by Indian company Quasar Media ... how is this Microsoft's fault?

TekGun TekGun said:

The store is not run by Microsoft, the store is owned and operated by a Indian company that sells MS stuff.

ikesmasher said:

i mean, it just seems wierd that they would actually post the passwords without covering them, as many of those people might use that password for other services, too.

Leeky Leeky said:

I considered it safe given that the full email addresses and usernames were not disclosed. As they stand, the passwords are worthless without the other credentials required to log into various services online. The information released in that article image is actually less information than would normally be released by Anonymous when they upload data to Pastebin, for example.

Also, it is important that people are aware that it was an Indian company Quasar Media that owned and operated the site, not Microsoft themselves. I can't imagine Microsoft being aware of unencrypted customer information prior to this incident, and I very much doubt they'd have allowed it to continue had they found out.

3DCGMODELER 3DCGMODELER said:

I think they forgot to tell them .....

...

" Oh, don't forget, to Encrypt the User data.!!"

Ya Think... Daaaa

Guest said:

number 119... has the WORST password, (you can see it in the picture)

email = first&lastname

pastword = first&lastname

dafaq?

Chazz said:

A lot of those email addresses can be figured out by looking at the other data. 119 and 130 shows that your attempt to censor blocks out just about 5 characters. So most of the email addresses can be figured out anyway using their first and last name from reference. I'd atleast censor their last name too.

Load all comments...

Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...
Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.