Microsoft has come under fire for disclosing a recent security breach that exposed 2.4 terabytes of data on 65,000 existing or potential customers over five years.

According to SOCRadar, the data covers the period from 2017 to August 2022. The archive contains user information, product orders/offers, project details and personal information and documents that may reveal intellectual property.

A little later, Microsoft released its own statement saying it was a security company. “This has greatly exaggerated the scale of the problem”such as some of the open data included “duplicate information with multiple links to the same emails, projects, and users”. The company also said: “The issue was caused by an accidental misconfiguration of an unused end device in the Microsoft ecosystem and is not the result of a security vulnerability”.

The message is missing important details, such as a more detailed description of the leaked data or how many existing or potential customers Microsoft believes were actually affected. Instead, Ars Technica notes that the message repulsed SOCRadar because it uses numbers that Microsoft disagrees with and includes a search engine that people can use to determine if their data is in a vulnerable box.

Critics also accused Microsoft of notifying those directly affected. The company contacted the affected organizations via the Message Center, the internal messaging system Microsoft uses to communicate with administrators. Not all administrators have access to this tool, so some messages may go unnoticed. Microsoft also said in direct messages posted on Twitter that the company is not required by law to report the error to the authorities.