LAPSUS$ source code theft from Microsoft via a single compromised account
In March 2022 LAPSUS$ claimed to have stolen portions of Microsoft source code. Microsoft said on March 22, 2022 that a single account had been compromised, granting limited access, and that no customer code or data was involved. Microsoft's report on the group, which it tracks as DEV-0537, described its methods: buying credentials and session tokens, Redline password stealer, paying insiders, SIM swapping and spamming MFA prompts.
- Victim
- Microsoft
- Industry
- Technology
- Country
- United States
- Intrusion began
- Mar 2022
- First disclosed
- Mar 22, 2022
- Actor
- LAPSUS$ (DEV-0537) (Extortion group)
- Initial access
- Stolen credentials
- Identity control that failed
- Authentication
- MFA
- Not disclosed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
Phishing-resistant MFA, device-bound sessions and alerting on unusual repository access counter every entry method Microsoft listed for this group.
Sources
- DEV-0537 criminal actor targeting organizations for data exfiltration and destruction, Microsoft Security Blog, Mar 22, 2022
- Review of the Attacks Associated with Lapsus$ and Related Threat Groups, Cyber Safety Review Board (CISA), Aug 10, 2023
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- TeamViewer corporate IT intrusion via a compromised employee account 2024 · Stolen credentials
- GhostAction returns: hijacked GitHub accounts push secret-stealing workflows 2026 · Stolen credentials
- PowerSchool SIS data theft through a compromised support-portal credential 2025 · Stolen credentials
- AT&T call and text records stolen from its Snowflake workspace 2024 · Stolen credentials
Cite this record
SWI Community Team. (2026). LAPSUS$ source code theft from Microsoft via a single compromised account. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2022-microsoft-lapsus-account/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.