Microsoft Makes Security Staff Cuts

Every week, ISMG rounds up cybersecurity incidents and breaches around the world. This week, Microsoft laid off security staff and released Patch Tuesday, Russian hackers intensified attacks on Ukraine in 2024, Telefónica confirmed a breach, a Tennessee mortgage leader reported a breach and the Texas AG sued Allstate over driver data collection.

See Also: Gartner Guide for Digital Forensics and Incident Response

Microsoft Makes Security Staff Cuts Months After Cyber Commitment

Microsoft this week laid off employees in its security division despite the computing giant in May 2024 vowing that it would prioritize “security above all else.”

A Microsoft spokesperson told Business Insider the layoffs were small – though a figure wasn’t specified – and unrelated to job cuts targeting underperforming employees across the company. Microsoft didn’t respond to a request for comment. Microsoft employed 228,000 people as of June 30, 2024, up 3.2% from 221,000 employees a year earlier, regulatory filings stated.

Security researcher Kevin Beaumont wrote on Mastodon Thursday that Microsoft has laid off more employees in the company’s security division beyond the 5% cut across the company for performance reasons. Beaumont worked at Microsoft from June 2020 to April 2021 as a senior threat intelligence analyst.

The security layoffs come just four months after Microsoft allocated 34,000 engineers to embed security into the company’s operations as part of the largest cybersecurity engineering project in the firm’s history. A federal empaneled Cyber Safety Review Board in April 2024 blamed Microsoft’s “corporate culture that deprioritized enterprise security investments” for allowing preventable security breaches (see: How Microsoft Is Beefing Up Security With 34,000 Engineers).

CEO Satya Nadella “is very clear: security is top priority, quality is top priority, and then balance with all the customer product feature needs,” Joy Chik, president of identity and network access at Microsoft, told ISMG in September 2024. “That clear message on priority is really important.”

Microsoft’s First Patch Tuesday of the year addresses 159 vulnerabilities, including eight zero-days, with three actively exploited. These include CVE-2025-21333, CVE-2025-21334 and CVE-2025-21335, which involve Windows Hyper-V and allow attackers to gain system privileges. All three were disclosed anonymously.

Five publicly disclosed zero-days were also patched, including CVE-2025-21275, an elevation of privilege flaw in the Windows App Installer, and CVE-2025-21308, a Windows themes spoofing vulnerability allowing Windows NTLM credential theft. Unpatched.ai discovered three additional remote code execution vulnerabilities in Microsoft Access.

The update also addresses 12 critical flaws across elevation of privilege, remote code execution and information disclosure vulnerabilities. Affected systems include Windows 10, Windows 11 and various Microsoft applications.

Users with Citrix’s Session Recording software installed have reported applying the patch, with Citrix advising its customers to stop the software before installing the patch and re-enabling it afterward.

Ukraine’s State Service of Special Communications and Information Protection reported that Russia-linked hacker groups ramped up cyberattacks on Ukraine in 2024, focusing on espionage, financial theft and psychological operations. The agency identified 1,042 cybersecurity incidents over the past year targeting government and defense agencies as well as critical infrastructure, often using compromised accounts and email-distributed malware as attack vectors.

Three key threat groups – UAC-0010 or Gamaredon, UAC-0006 and UAC-0050 – are behind most incidents. Gamaredon, active since 2013 and linked to Russia’s Federal Security Service, accounted for 277 attacks, aimed primarily at Ukrainian state agencies and defense enterprises. UAC-0006, known for deploying SmokeLoader malware, executed 174 incidents aimed at financial theft in Ukrainian institutions. UAC-0050 conducted disinformation campaigns, including emails warning of terrorist attacks, alongside espionage and financial theft.

The report highlighted a shift in tactics, with hackers focusing on areas critical to Russia’s military efforts. Ukrainian researchers expect destructive attacks on critical infrastructure, including energy facilities, to persist despite the current focus on espionage and influence operations.

Spanish telecom giant Telefónica confirmed a breach of its internal Jira-based ticketing system after stolen data appeared on Breach Forums. Four hackers, using aliases DNA, Grep, Pryx and Rey, claimed responsibility, exploiting compromised employee credentials to access the system. Telefonica responded by blocking access and resetting affected accounts. A link to the data on BreachForums appears inoperative.

In a statement shared with media, Telefónica said an investigation is ongoing but hackers don’t appear to have affected personal accounts.

Attackers reportedly scraped 2.3 gigabytes of internal data, including tickets opened with @telefonica.com email addresses, possibly linked to customer issues. Pryx stated no extortion attempt was made before leaking the data online. The hackers are linked to Hellcat ransomware, also implicated in a recent 40 gigabyte data theft at Schneider Electric.

A Tennessee mortgage lender suffered a cyberattack in December 2024 that exposed sensitive customer data. The breach at Mortgage Investors Group began on Dec. 11, 2024, and was discovered the following day. MIG said unauthorized access to its systems compromised the personal and financial information of an undisclosed number of customers.

MIG did not confirm if the attack involved extortion, but the Black Basta ransomware gang claimed responsibility.

Texas Attorney General Ken Paxton filed a lawsuit against Allstate and its data subsidiary Arity for collecting, using and selling driving data from over 45 million Americans without consent. The lawsuit accuses the companies of embedding tracking software in popular apps such as Life360, GasBuddy, Fuel Rewards and Routely to covertly gather users’ location and driving data every 15 seconds. These apps have been downloaded over 115 million times from Google Play alone.

According to the complaint, Allstate created the world’s largest driving behavior database by collecting trillions of miles of location data and used it to adjust insurance quotes and renewals, raising premiums based on the data. Allstate and Arity also reportedly sold this data to other insurers, enabling similar practices.

The lawsuit alleges violations of the Texas Data Privacy and Security Act, the Data Broker Law, and the Texas Insurance Code. It also claims Allstate purchased location data from automakers, including Toyota, Lexus and Jeep, to profile drivers further.

Paxton is seeking civil penalties of up to $7,500 per TDPSA violation and $10,000 under the Texas Insurance Code, restitution for affected consumers, destruction of unlawfully obtained data, and an injunction to halt the practices.

Allstate responded, stating Arity collects data transparently and with consent, ensuring compliance with laws and regulations.

Other Stories from Last Week

With reporting from Information Security Media Group’s Michael Novinson in Massachusetts.