Antitrust Law Daily Wrap Up, CONSUMER PROTECTION NEWS: Wyden asks FTC to probe Microsoft’s ‘gross cybersecurity negligence’ after health care hack, (Sep 11, 2025)
Organizations Mentioned:Microsoft
The software giant’s continued support for ancient, insecure technology exposes customers to needless risks.
Microsoft Corp.’s “de facto monopoly” over operating systems and “gross cybersecurity negligence” should be investigated by the Federal Trade Commission, Sen. Ron Wyden (D., Ore.) said in a letter to FTC Chairman Andrew Ferguson. Sen. Wyden said Microsoft’s inattention to security issues led to a 2024 ransomware attack on the Ascension health care system, exposing the personal data of 5.6 million people.
“The hackers exploited a technique called Kerberoasting to gain access to privileged accounts on Ascension’s Microsoft Active Directory server. This hacking technique leverages Microsoft’s continued support by default for an insecure encryption technology from the 1980s called RC4 that federal agencies and cybersecurity experts, including experts working for Microsoft, have for more than a decade warned is dangerous,” Sen. Wyden said.
“Although Microsoft’s software also supports a secure encryption technology approved and recommended by the U.S. government, known as the Advanced Encryption Standard, this vastly superior encryption technology is not required by default in Windows. Microsoft’s continued support for the ancient, insecure RC4 encryption technology needlessly exposes its customers to ransomware and other cyber threats,” he said.
His staff urged Microsoft to warn its customers of the Kerberoasting threat, and the company did so in “a highly technical blog post on an obscure area of the company’s website on a Friday afternoon,” Sen. Wyden noted.
“Microsoft took no meaningful steps to publicize this blog post. Moreover, Microsoft declined to explicitly warn its customers that they are vulnerable to the Kerberoasting hacking technique unless they change the default settings chosen by Microsoft,” he said.
In addition, Microsoft promised 11 months ago to release a software update to disable the outdated RC4 encryption technology but has not done so, he said.
“Instead of delivering secure software to its customers, Microsoft has built a multibillion dollar secondary business selling cybersecurity add-on services to those organizations that can afford it. At this point, Microsoft has become like an arsonist selling firefighting services to their victims,” Sen. Wyden said.
“Microsoft has utterly failed to stop or even slow down the scourge of ransomware enabled by its dangerous software,” he told Chairman Ferguson. “The FTC’s mission to protect Americans from deceptive and unfair business practices and promote fair competition obligates the agency to investigate Microsoft’s negligence in a marketplace where its dominance has profound, foundational influence on cybersecurity practices and to hold the company accountable for its shortcomings.”
A Microsoft spokesperson, however, said the company had plans to fix the default configuration of RC4 encryption by early next year and had already disabled a separate outdated encryption tool.
“RC4 is an old standard, and we discourage its use both in how we engineer our software and in our documentation to customers—which is why it makes up less than .1% of our traffic. However, disabling its use completely would break many customer systems,” the spokesperson said via e-mail.
“For this reason, we’re on a path to gradually reduce the extent to which customers can use it, while providing strong warnings against it and advice for using it in the safest ways possible,” the spokesperson added. “We have it on our roadmap to ultimately disable its use. We’ve engaged with the Senator’s office on this issue and will continue to listen and answer questions from them or others in government.”
News: ConsumerProtection Privacy FederalTradeCommissionNews