Breaking: Microsoft Store India has been hacked! (Update: Database hacked, Passwords exposed)
We just got tipped by Aman that Microsoft India store has been hacked. I just checked it a minute back and he was right. It has been hacked. This is the homepage at this moment (10:00 PM IST):
Context & Ripple Effects
The hack lands a year after Microsoft confirmed Yahoo! as the culprit in an earlier data leak tied to its accounts, making this the second credential-related incident to touch Microsoft's consumer properties in roughly twelve months. This time the target is narrower — the Indian online storefront — but the exposure is more direct: the attackers reached the database itself, and user passwords were taken.
The story travelled fast for a regional incident: within hours of Windows Phone Sauce confirming the defacement at 10:00 PM IST on February 12, Engadget, Ubergizmo, WebProNews, BGR India and at least four other outlets had carried it, with the initial tip credited to a reader named Aman.
First-order effects
- Customers of Microsoft Store India whose records were in the compromised database have exposed passwords and need to change them immediately — especially any reused on Hotmail or other Microsoft services.
- Microsoft's India e-commerce operation faces an immediate trust problem: the storefront is defaced and inaccessible while the company has made no public statement on the scope of the database access.
Second-order effects
- Password reuse turns a storefront breach into an ecosystem risk: credentials lifted from the store can be replayed against Hotmail, SkyDrive and Xbox Live accounts sharing the same email address.
- The incident complicates Microsoft's retail ambitions in the region — reports circulating days earlier had the company planning new stores, though those expansion plans remain unconfirmed.
Third-order effects
- Regional storefronts and secondary properties are emerging as the weak perimeter of large vendors' security postures — easier targets than core services but holding real customer data.
- With no mandatory breach-disclosure regime in India at this point, disclosure depends on researchers and tipsters rather than the company, leaving affected users learning of their exposure from blogs first.
The trend: Consumer-facing regional storefronts are becoming the soft entry points in major vendors' breach history, with exposed passwords converting single-site hacks into ecosystem-wide credential risks.