Microsoft
Microsoft disclosed that Midnight Blizzard accessed and exfiltrated email from a small percentage of corporate accounts, including senior leadership.
+1.5% MSFT vs +3.5% SPY
This site shows how share prices moved after an incident became public. It does not prove that the incident caused the move. Company news, sector moves and the wider market can affect every result. Educational only — not investment advice.
Disclosure timing
When could the market react?
The baseline is the last adjusted close before the news was public. The reaction session is the first close afterward.
- 01Baseline sessionJan 19, 2024
Normalized to 100 for both MSFT and SPY.
- 02Public disclosureJan 19, 2024, 4:39 PM EST
Documented publication time.
- 03First reaction closeJan 22, 2024
-0.5% company total return versus +0.2% for SPY; -0.8 pp market-relative return.
Time windows
Company vs SPY
Each row uses the last trading session on or before its target date. “Market-relative” is the company return minus the SPY return, in percentage points.
| Window | Endpoint | MSFT | SPY | Market-relative | Signal |
|---|---|---|---|---|---|
| First reaction | Jan 22, 2024 | -0.5% | +0.2% | -0.8 pp | Below SPY |
| +7 days | Jan 26, 2024 | +1.3% | +1.0% | +0.3 pp | Above SPY |
| +1 month | Feb 16, 2024 | +1.5% | +3.5% | -2.0 pp | Below SPY |
| +3 months | Apr 19, 2024 | +0.3% | +3.0% | -2.7 pp | Below SPY |
| +6 months | Jul 19, 2024 | +10.0% | +14.5% | -4.5 pp | Below SPY |
| +12 months | Jan 17, 2025 | +8.4% | +25.5% | -17.0 pp | Below SPY |
Compare with current catalog aggregates
| Window | This case | Catalog median | Catalog mean | n |
|---|---|---|---|---|
| First reaction | -0.8 pp | -0.8 pp | -1.5 pp | 30 |
| +7 days | +0.3 pp | -2.0 pp | -4.0 pp | 30 |
| +1 month | -2.0 pp | -6.6 pp | -6.8 pp | 30 |
| +3 months | -2.7 pp | -5.1 pp | -6.6 pp | 30 |
| +6 months | -4.5 pp | -5.6 pp | -7.5 pp | 30 |
| +12 months | -17.0 pp | -3.7 pp | -10.1 pp | 30 |
Normalized total return
MSFT compared with SPY
Baseline session = 100. Adjusted close reflects splits and reinvested distributions.
Microsoft had +8.4% company total return versus +25.5% for SPY; -17.0 pp market-relative return. The chart shows normalized adjusted-close performance for up to 24 months.
View tabular chart fallback
| Date | MSFT | SPY |
|---|---|---|
| Jan 19, 2024 | 100.0 | 100.0 |
| Feb 20, 2024 | 101.2 | 103.0 |
| Mar 20, 2024 | 106.9 | 108.2 |
| Apr 19, 2024 | 100.3 | 103.0 |
| May 20, 2024 | 107.1 | 110.2 |
| Jun 20, 2024 | 112.2 | 113.7 |
| Jul 22, 2024 | 111.5 | 115.7 |
| Aug 20, 2024 | 107.1 | 116.5 |
| Sep 19, 2024 | 110.6 | 119.1 |
| Oct 18, 2024 | 105.5 | 122.3 |
| Nov 18, 2024 | 104.9 | 123.1 |
| Dec 18, 2024 | 110.5 | 122.7 |
| Jan 22, 2025 | 112.8 | 127.3 |
| Feb 21, 2025 | 103.4 | 126.0 |
| Mar 24, 2025 | 99.5 | 120.9 |
| Apr 23, 2025 | 94.8 | 112.7 |
| May 22, 2025 | 115.4 | 122.8 |
| Jun 24, 2025 | 124.3 | 128.2 |
| Jul 24, 2025 | 129.6 | 134.0 |
| Aug 22, 2025 | 128.9 | 136.3 |
| Sep 23, 2025 | 129.4 | 140.5 |
| Oct 22, 2025 | 132.3 | 141.4 |
| Nov 20, 2025 | 121.8 | 138.2 |
| Dec 22, 2025 | 123.4 | 145.5 |
| Jan 16, 2026 | 117.1 | 146.9 |
Price recovery
Recovered
Here, recovery only means that adjusted close reached the baseline again. It does not mean every effect of the incident ended.
- State
- Recovered
- Initial trough
- -0.5% on Jan 22, 2024
- Recovery close
- Jan 23, 2024
- Calendar days
- 4
- Observation cap
- 24 months after disclosure
Hypothetical $1,000
What would $1,000 have looked like?
Compare $1,000 in MSFT with $1,000 in SPY, bought and measured on the same dates.
Entry Jan 22, 2024 Exit Jul 22, 2024
Uses fractional shares and adjusted close. Leaves out taxes, fees and slippage. The holding period starts on the purchase date. This is a historical illustration, not an investment strategy.
Case note
Microsoft said a password-spray attack against a legacy non-production tenant led to access to a small percentage of corporate email accounts, including members of senior leadership and employees in security, legal and other functions.
The Item 1.05 filing was accepted after the regular session. January 19 is the baseline and Monday January 22 is the reaction session; disclosure classification does not imply that all subsequent movement was incident-caused.
Evidence
Sources and case review
We qualify each case before checking its price results. These links support the disclosure date, listing, incident and business impact.
- primary Jan 19, 2024Microsoft January 19, 2024 Form 8-K filing detail Microsoft / U.S. SEC Supports: Disclosure, Timing, Listing, Impact, Description
- primary Jan 19, 2024Microsoft actions following attack by nation-state actor Midnight Blizzard Microsoft Security Response Center Supports: Disclosure, Impact, Description
- Listing evidenceChecked Jul 20, 2026Microsoft January 19, 2024 Form 8-K filing detail U.S. Securities and Exchange Commission The filing identifies Microsoft as Nasdaq: MSFT and was accepted at 4:39:35 p.m. EST.
Why it is included. Microsoft was the direct victim, reported the event under Item 1.05, and described access to senior-leadership and security-related corporate email by a nation-state actor. Reviewed Jul 20, 2026.