This article is hilarious to me for some reason…
All 10 defendants were named John Doe because Microsoft doesn’t know their identity.
So Microsoft doesn’t know who the people are.
Microsoft didn’t say how the legitimate customer accounts were compromised but said hackers have been known to create tools to search code repositories for API keys developers inadvertently included in the apps they create. Microsoft and others have long counseled developers to remove credentials and other sensitive data from code they publish, but the practice is regularly ignored.
The accounts that were compromised were likely stolen because the account owners listed API creds directly in their code.
Microsoft didn’t outline precisely how the defendants' software was allegedly designed to bypass the guardrails the company had created.
Microsoft won’t explain how their system is busted.
The lawsuit alleges the defendants’ service violated the Computer Fraud and Abuse Act, the Digital Millennium Copyright Act, the Lanham Act, and the Racketeer Influenced and Corrupt Organizations Act and constitutes wire fraud, access device fraud, common law trespass, and tortious interference. The complaint seeks an injunction enjoining the defendants from engaging in “any activity herein.”
Whatever the hackers generated sure did piss Microsoft off.