Senator Wyden Urges FTC to Probe Microsoft for Ransomware-Linked Cybersecurity Negligence

U.S. Senator Ron Wyden has urged the Federal Trade Commission to probe Microsoft for what he calls “gross cybersecurity negligence” that enabled ransomware attacks on U.S. critical infrastructure, including healthcare networks, in a four-page letter to FTC Chairman Andrew Ferguson. The push follows Ascension’s ransomware incident last year, which involved the theft of personal and medical information linked to nearly 5.6 million individuals and disrupted access to electronic health records.

The breach was attributed to a ransomware group known as Black Basta, and Wyden’s office said attackers exploited "dangerously insecure default settings" in Microsoft software after a contractor clicked on a malicious link via Bing. The report notes Kerberoasting as a technique used to extract credentials from Active Directory, and Wyden’s office warned that RC4 remains enabled by default in some configurations, despite alerts and planned deprecation in future updates to Windows 11 and Windows Server 2025.

According to the U.S. Department of Health and Human Services, the breach ranks as the third-largest healthcare-related incident in the past year.