The United States Air Force confirmed on Wednesday that it has launched an investigation into a “privacy-related issue” after a reported breach of Microsoft’s SharePoint service disrupted access to files and tools.
The incident has raised concerns about the exposure of sensitive information, including Personally Identifiable Information (PII) and Protected Health Information (PHI).
Breach Notification Details
A breach notification, reportedly from the Air Force Personnel Center Directorate of Technology and Information, informed service members that SharePoint permissions had been compromised. The message said:
“This message is to inform you of a critical Personally Identifiable Information (PII) and Protected Health Information (PHI) exposure related to USAF SharePoint Permissions. As a result of this breach, all USAF SharePoints will be blocked Air Force-wide to protect sensitive information.”
The notification also suggested that related Microsoft services, including Teams and Power BI dashboards, would be blocked since they rely on SharePoint. It warned that restoration of these tools might take up to two weeks.
Conflicting Reports on Service Shutdown
Despite the notice, some confusion remains about the actual status of SharePoint and Teams. An Air Force spokesperson told The Register they “cannot confirm” whether the services have been blocked.
Another source claimed they were still actively using the tools on Tuesday. Microsoft, meanwhile, said they had “nothing to share at this time.”
Broader Security Concerns
This latest Air Force disruption follows a July incident in which SharePoint vulnerabilities were exploited by Chinese government hackers, criminal groups, and a ransomware gang.
That breach impacted more than 400 organizations by allowing attackers to exploit on-premises SharePoint servers and execute malicious code remotely.
What Comes Next
The Air Force has not yet clarified the scale of the current breach, the extent of the potential data exposure, or whether the incident is connected to the earlier exploitation of SharePoint.
Both Microsoft and the Air Force have been contacted for further comment as the investigation continues.
