{
  "id": 12229406,
  "title": "Open Microsoft database with 17 trillion total rows and 25,000 user accounts hacked by a bored teenager — but he's been well-paid for his actions",
  "url": "https://urgent.news/2026/10/05/open-microsoft-database-with-17-trillion-total-rows-and-25-000-user",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-05T21:10:00.000Z",
  "source": {
    "name": "TechRadar",
    "slug": "techradar",
    "url": "https://www.techradar.com/pro/security/open-microsoft-database-with-17-trillion-total-rows-and-25-000-user-accounts-hacked-by-a-bored-teenager-but-hes-been-well-paid-for-his-actions"
  },
  "original_language": "en",
  "account": "A 16-year-old hacker known as Faav gained administrative access to Microsoft's internal Titan analytics service through a flaw in how the system handled login tokens. He discovered that the service never checked the cryptographic signature of unsigned tokens, allowing him to bypass security measures. The Titan service contained an estimated 17.3 trillion stored rows and a metadata table listing around 25,000 accounts. Faav, who used an orchestration bot called Antares to automate the process, detailed his findings on September 5, 2026, and Microsoft paid him $5,000 to resolve the issue. Microsoft later admitted that the bug could have been catastrophic if exploited by malicious actors. The teenager's discovery highlights the potential vulnerabilities in modern web services and the importance of robust security measures, such as verifying cryptographic signatures in login tokens.",
  "summary": "A 16-year-old set one login field to \"admin,\" and an estimated 17.3 trillion Microsoft rows became accessible.",
  "key_points": [
    "16-year-old hacker Faav exploited Titan analytics service flaw",
    "Service lacked cryptographic signature verification for login tokens",
    "Microsoft paid Faav $5,000 to fix the vulnerability"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}