Hackers exploited zero-days in Microsoft Exchange — and 250,000 servers were compromised

In March 2021, Microsoft disclosed that a state-sponsored hacking group (dubbed 'Hafnium,' believed to be Chinese) had exploited four zero-day vulnerabilities in Microsoft Exchange Server, the email server software used by hundreds of thousands of organizations worldwide.

The hackers used the vulnerabilities to install web shells on Exchange servers, giving them persistent access to email accounts. An estimated 250,000 servers were compromised before Microsoft released emergency patches. The affected organizations included small businesses, local governments, schools and enterprises.

The breach was notable for its scale and the diversity of targets: unlike SolarWinds, which targeted specific high-value organizations, the Exchange hack was a mass exploitation that affected organizations of all sizes. The case illustrated how a zero-day in widely used infrastructure software can compromise hundreds of thousands of organizations simultaneously, and how the patch gap — the time between exploitation and patching — is the window of vulnerability.