Random people showing up in Track Changes??

Hello, I have just received a message from Microsoft indicating that this was investigated and is now fixed (and linking to this thread). I have copied the message below FYI:

My name is [edited], I am Microsoft 365 Support Ambassador and happened to come across this case while performing an internal audit. I am able to confirm that the issue you reported was investigated by the SharePoint Online and Office Product Groups and a 'fix' was pushed out on February 9th to prevent it from happening moving forward. For transparency, here is a forum post where a few other customers are discussing the same issue: Random people showing up in Track Changes?? - Microsoft Community

Our product engineering team received reports of an issue in which users noticed that several formatting edits that were made with “Track Changes” enabled in Microsoft Word were showing the name of an individual outside of their organization. We have determined the source of the problem, and stopped the issue as of Thursday, February 9, 2023 from occurring going forward; however, documents already affected by this issue may still see the incorrect author. Additionally, we’re proactively exploring additional service monitoring to detect and prevent this issue from occurring again.

For clarity, document permissions were not affected*, and this issue did not allow users to access any document without proper permissions or authorization. Document names or content from within your organization were never visible to any user who was not explicitly granted permission to the document.*

Here are a few FAQs on this issue that engineering provided.

Q: Which versions of Microsoft Word were affected?

A: Any version of Microsoft 365 apps including Semi-Annual Channel were in scope for this issue.

Q: What is the timeframe of impact?

A: Between January 31, 2023 and February 9, 2023.

Q: What caused this issue?

A: A code issue caused a problem with the attribution of Tracked Changes edits in documents in some scenarios, such as coauthoring. In these cases, Track Changes may incorrectly show that edits were made by unknown users that may be outside the document owner’s organization. This misattribution applies to both new edits as well as edits with Track Changes that are already in the document when it’s opened. In these cases, the unknown users are shown by mistake and did not, at any time, have any access or visibility of your affected documents.

Q: Is there a breach of our security or Microsoft’s services or apps?

A: There is no security incident for this event. We have confirmed that this issue did not allow external access to your documents.

Q: Was our data exposed to anyone outside our organization without our consent?

A: No, we have confirmed that this issue did not allow external access or visibility to your documents. This was a Microsoft Word document metadata problem which incorrectly listed contributing users within the user interface of your affected documents that are not part of your organization.

Q: Will this issue continue to occur for further Microsoft Word documents?

A: This issue was mitigated as of Friday, February 10, 2023, at 3:00 AM UTC. Your organization will not experience any newly occurring instances of this issue within your co-authored documents.

Q: How can I repair my affected documents to remove the incorrectly tagged contributors?

A: Users can leverage version history to return the document to its last known good state prior to the appearance of these external user tags within the user interface.

Q: What data was shown from my organization and where?

A: This issue may have resulted in the first and last names of one or more of your users contributing to a shared document being inadvertently tagged as a contributor within an unrelated document external to your environment.

Hi Jim,

The Word Product Team have opened a bug report for this issue, which had been reported by some enterprise customers. Therefore, we can expect a fix in due course.

We have experienced the same issue today for a newly created document. Leveraging Word 365, our org level has experienced random users with names such as "Honeydew" in our documents that are on our personal drives and shared with only one individual for example. We will be placing a ticket as instructed above.

I have recentlly seen this in my organisation, both on SharePoint and Onedrive hosted Word docs. The true authors tracked changes are replaced at some time during editing by another persons name. One of the docs, the same formatting is attributed to 3 different random people over an hour period - w've been looking back through previous versions.

One of the questions I have, is what is the source where these names could be coming from. They are not guests in our Azure Active Directory, and none of the authors of the affected documents have any knowledge of the individuals. The contact card where the formatting change is recorded also does not show any information.

This does look like a bug, as the permissions on the SharePoint site / OneDrive location do not allow any guests or external users, however this raises concerns with users, when an unknown name just appears on a document.

The documents are also created from scratch, and not using templates.

Gareth

Hello Brian,

Did you write it or are you editing a file someone else wrote? If you are editing someone else's work, it would be expected - and its possible the reviewers have the same name as the more famous people you found.

Are you using a template from the internet?

-- Diane

Give back to the Community. Help the next person who has this issue by indicating if this reply solved your problem. Click Yes or No below.