MSFT NASDAQ Security breach

Microsoft

Microsoft disclosed that Midnight Blizzard accessed and exfiltrated email from a small percentage of corporate accounts, including senior leadership.

1 month vs SPY -2.0 pp Below SPY

+1.5% MSFT vs +3.5% SPY

DisclosureJan 19, 2024, 4:39 PM EST
Company’s roleDirect victim
Available data12 months complete
Share typeCommon stock · MSFT

This site shows how share prices moved after an incident became public. It does not prove that the incident caused the move. Company news, sector moves and the wider market can affect every result. Educational only — not investment advice.

Disclosure timing

When could the market react?

The baseline is the last adjusted close before the news was public. The reaction session is the first close afterward.

  1. 01Baseline sessionJan 19, 2024

    Normalized to 100 for both MSFT and SPY.

  2. 02Public disclosureJan 19, 2024, 4:39 PM EST

    Documented publication time.

  3. 03First reaction closeJan 22, 2024

    -0.5% company total return versus +0.2% for SPY; -0.8 pp market-relative return.

Time windows

Company vs SPY

Each row uses the last trading session on or before its target date. “Market-relative” is the company return minus the SPY return, in percentage points.

Returns measured from the shared baseline session
WindowEndpointMSFTSPYMarket-relativeSignal
First reaction Jan 22, 2024 -0.5% +0.2% -0.8 pp Below SPY
+7 days Jan 26, 2024 +1.3% +1.0% +0.3 pp Above SPY
+1 month Feb 16, 2024 +1.5% +3.5% -2.0 pp Below SPY
+3 months Apr 19, 2024 +0.3% +3.0% -2.7 pp Below SPY
+6 months Jul 19, 2024 +10.0% +14.5% -4.5 pp Below SPY
+12 months Jan 17, 2025 +8.4% +25.5% -17.0 pp Below SPY
Compare with current catalog aggregates
WindowThis caseCatalog medianCatalog meann
First reaction-0.8 pp-0.8 pp-1.5 pp30
+7 days+0.3 pp-2.0 pp-4.0 pp30
+1 month-2.0 pp-6.6 pp-6.8 pp30
+3 months-2.7 pp-5.1 pp-6.6 pp30
+6 months-4.5 pp-5.6 pp-7.5 pp30
+12 months-17.0 pp-3.7 pp-10.1 pp30

Normalized total return

MSFT compared with SPY

Baseline session = 100. Adjusted close reflects splits and reinvested distributions.

Microsoft had +8.4% company total return versus +25.5% for SPY; -17.0 pp market-relative return. The chart shows normalized adjusted-close performance for up to 24 months.

View tabular chart fallback
Representative normalized chart points, sampled approximately monthly
DateMSFTSPY
Jan 19, 2024100.0100.0
Feb 20, 2024101.2103.0
Mar 20, 2024106.9108.2
Apr 19, 2024100.3103.0
May 20, 2024107.1110.2
Jun 20, 2024112.2113.7
Jul 22, 2024111.5115.7
Aug 20, 2024107.1116.5
Sep 19, 2024110.6119.1
Oct 18, 2024105.5122.3
Nov 18, 2024104.9123.1
Dec 18, 2024110.5122.7
Jan 22, 2025112.8127.3
Feb 21, 2025103.4126.0
Mar 24, 202599.5120.9
Apr 23, 202594.8112.7
May 22, 2025115.4122.8
Jun 24, 2025124.3128.2
Jul 24, 2025129.6134.0
Aug 22, 2025128.9136.3
Sep 23, 2025129.4140.5
Oct 22, 2025132.3141.4
Nov 20, 2025121.8138.2
Dec 22, 2025123.4145.5
Jan 16, 2026117.1146.9

Price recovery

Recovered

Here, recovery only means that adjusted close reached the baseline again. It does not mean every effect of the incident ended.

State
Recovered
Initial trough
-0.5% on Jan 22, 2024
Recovery close
Jan 23, 2024
Calendar days
4
Observation cap
24 months after disclosure

Hypothetical $1,000

What would $1,000 have looked like?

Compare $1,000 in MSFT with $1,000 in SPY, bought and measured on the same dates.

MSFT value $1,121 Microsoft
SPY value $1,155 US market benchmark
Difference vs SPY -$33 Observed result

Entry Jan 22, 2024 Exit Jul 22, 2024

Uses fractional shares and adjusted close. Leaves out taxes, fees and slippage. The holding period starts on the purchase date. This is a historical illustration, not an investment strategy.

Case note

Microsoft said a password-spray attack against a legacy non-production tenant led to access to a small percentage of corporate email accounts, including members of senior leadership and employees in security, legal and other functions.

The Item 1.05 filing was accepted after the regular session. January 19 is the baseline and Monday January 22 is the reaction session; disclosure classification does not imply that all subsequent movement was incident-caused.

Evidence

Sources and case review

We qualify each case before checking its price results. These links support the disclosure date, listing, incident and business impact.

  1. primary Jan 19, 2024
    Microsoft January 19, 2024 Form 8-K filing detail Microsoft / U.S. SEC Supports: Disclosure, Timing, Listing, Impact, Description
  2. primary Jan 19, 2024
    Microsoft actions following attack by nation-state actor Midnight Blizzard Microsoft Security Response Center Supports: Disclosure, Impact, Description
  3. Listing evidenceChecked Jul 20, 2026
    Microsoft January 19, 2024 Form 8-K filing detail U.S. Securities and Exchange Commission The filing identifies Microsoft as Nasdaq: MSFT and was accepted at 4:39:35 p.m. EST.

Why it is included. Microsoft was the direct victim, reported the event under Item 1.05, and described access to senior-leadership and security-related corporate email by a nation-state actor. Reviewed Jul 20, 2026.