[News](/news) Thousands of Microsoft Customers Exposed Through Critical Cosmos Database Flaw [Blog](/blog)[Breaches](/breaches)[Resources](/resources)[News](/news) # Thousands of Microsoft Customers Exposed Through Critical Cosmos Database Flaw ##### [Edward Kost](/team/edward-kost) August 30, 2021 The cybersecurity spotlight hasn’t shifted from Microsoft for most of 2021. The latest in a string of critical security issues is a vulnerability in Microsoft Azure’s flagship Cosmos DB Database. The exposure, [discovered by security company Wiz](https://www.wiz.io/blog/chaosdb-how-we-hacked-thousands-of-azure-customers-databases), impacted thousands of customers hosting their data on the cloud solution, including [Coca-Cola, Skype, and Rolls-Royce](https://gotcosmos.com/about/customers). A series of flaws in a Cosmos DB feature allowed anyone to download, delete or manipulate mass collections of commercial databases with both read and write access to the underlying Cosmos DB architecture. The principal flaw that opened this pathway is linked to a Jupyter Notebook feature used for data vizualization. A series of misconfigurations permitted privileged escalation into customer notebooks which could then lead to the discovery of each customer’s Cosmos DB primary key - allowing full read, write, and delete access to customer data. Wiz reported the issue to Microsoft’s security team who then disabled the Juptyer feature within 48 hours. Because these primary keys cannot be changed by Microsoft, all impacted customers were urged to create new keys. This exposure was remediated before it was discovered and exploited by cyber attackers, preventing a potentially catastrophic data breach. On August 23, another customer database exposure was [announced by the UpGuard research team](https://www.upguard.com/breaches/power-apps). Faulty default permission settings in Microsoft’s Power Apps exposed 38 million user records including social security numbers, COVID-19 vaccination data, and job applicant data. Earlier in August, [CISA issued an urgent warning](https://us-cert.cisa.gov/ncas/current-activity/2021/08/21/urgent-protect-against-active-exploitation-proxyshell) about three vulnerabilities facilitating remote code execution on Microsoft Exchange servers. In July, a [Windows print spooler remote code vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527), if exploited, would have allowed attackers to run arbitrary codes with system privileges to install malicious programs, delete data, or create new accounts with full user rights. And in December 2020, [Solarwinds hackers accessed Microsoft’s source code](https://msrc-blog.microsoft.com/2020/12/31/microsoft-internal-solorigate-investigation-update/) repositories for its Azure, Intune, and Exchange components. These exposures highlight the complexity of securing a cloud environment. Because the transition to cloud technology is necessary to maintain a competitive advantage, the future of data security depends upon a [reliable defense for this multiplex attack surface](https://www.upguard.com/product/breach-risk). ## How secure is Microsoft? Microsoft develops and licenses software products, devices, and services. The company's core offerings include the Windows operating system, Office productivity suite, Azure cloud computing platform, and Xbox gaming consoles. * View our free preliminary report on Microsoft’s security posture * 13 risk factors, including email security, SSL, DNS health, open ports and common vulnerabilities [View Microsoft's score](/security-report/microsoft) [View score](/security-report/microsoft) [https://www.microsoft.com](/security-report/microsoft) ### Sign up for our newsletter UpGuard's monthly newsletter cuts through the noise and brings you what matters most: our breaking research, in-depth analysis of emerging threats, and actionable strategic insights. ## Latest news Stay up-to-date with the latest news in cybersecurity. [](/news/hugging-face-data-breach-2026-07-20) #### [Hugging Face data breach: key facts and what we know so far](/news/hugging-face-data-breach-2026-07-20) A data breach involving Hugging Face was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 20, 2026 [](/news/ey-data-breach-2026-07-19) #### [EY data breach: what happened and what's at risk](/news/ey-data-breach-2026-07-19) A data breach involving EY was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 15, 2026 [](/news/south-florida-injury-convenient-care-data-breach-2026-07-16) #### [South Florida Injury & Convenient Care data breach exposes names and Social Security numbers](/news/south-florida-injury-convenient-care-data-breach-2026-07-16) A data breach involving South Florida Injury & Convenient Care was reported in July 2026. See incident details, impact on customers, and security measures. ##### [UpGuard Team](/team/upguard) July 15, 2026 [](/news/park-west-psychology-data-breach-2026-07-16) #### [Park West Psychology data breach: what happened and what's at risk](/news/park-west-psychology-data-breach-2026-07-16) A data breach involving Park West Psychology was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 15, 2026 [](/news/fall-river-municipal-credit-union-data-breach-2026-07-16) #### [Fall River Municipal Credit Union data breach: what happened and what's at risk](/news/fall-river-municipal-credit-union-data-breach-2026-07-16) A data breach involving Fall River Municipal Credit Union was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [](#) July 14, 2026 [](/news/npcil-data-breach-2026-07-16) #### [NPCIL data breach: World Leaks claims exposure of Kudankulam Nuclear Power Plant files](/news/npcil-data-breach-2026-07-16) A data breach involving NPCIL was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 14, 2026 [View all news](/news) ## Protect your organization Get in touch or book a free demo. [Contact sales](/demo) [Free demo](/demo) ##### Free instant security score ## How secure is your organization? Request a free cybersecurity report to discover key risks on your website, email, network, and brand. * Instant insights you can act on immediately * Hundreds of risk factors including email security, SSL, DNS health, open ports and common vulnerabilities [Free score](/instant-security-score)