Microsoft India Store Hacked, User Database Exposed

IDG News Service — Microsoft is investigating a "limited compromise" of the company's online store in India, the company said Monday.

"The store customers have already been sent guidance on the issue and suggested immediate actions," the company said in a statement.

The user names and passwords of some customers may have been leaked, and users are being advised to change their passwords, said a person close to the situation, who declined to be named. Financial information of customers has not been exposed, the person said.

The store was defaced over the weekend by hackers who claimed to be Chinese. The hackers also released images of what appeared to be lists of users' names and passwords.

The Microsoft website is managed by a third-party service provider and was still down on Monday. Microsoft said on the site that it is working to restore access as quickly as possible.

The relatively unknown hacker group, called EvilShadow Team, wrote in Mandarin in a blog post that it had changed the main page of the store, and placed an image of China's flag on it because it wanted Microsoft to pay attention. "We are not famous, we know that there are other experts among us, people who are even better," the group said.

India has border disputes with both China and Pakistan, and the animosity gets reflected on social networks, and in hacks of websites on both sides of the borders. Some top Indian websites including that of the country's Central Bureau of Investigation have been hacked.

1,651 websites were defaced in India in November, according to data from the Indian Computer Emergency Response Team (CERT-In).

Michael Kan in Beijing contributed to this report.

John Ribeiro covers outsourcing and general technology breaking news from India for The IDG News Service. Follow John on Twitter at @Johnribeiro. John's e-mail address is john_ribeiro@idg.com