Azure account compromised

Question

Azure account compromised

Muthu Kumar 0

Hi Seems our account being compromised for subscription:cb662a62-bdf2-4b78-b1a4-5be8de5f36ad,

We have enabled 2FA for portal login, untill Jan 2024 the bill was within our budget and we didn't suspect any suspecious activity, Feb the beill is 90K RS which is beyond our limit, when we checked the bill found there is 2 VM was running which we are not using.

We received email stating we used Azure for illegal activities yesterday.

Regards

Muthu Kumar 0 Reputation points

2024-03-12T10:51:27.85+00:00

Hi Team,

Thanks for faster response.

Understand from support engineer our subscription is in dormant state currently.

we have tried to login using entra ID, which we never used earlier, tried password reset but, our 2FA settings is showing different phone no and auth app which we never setup up.

Open up another ticket : 2403120030003178 to help reset 2FA and enable only email method, which is linked to our subscription.

Please re-enable our subscription earlier or remove dormant state to allow us to move to another subscription.

Regards.
SadiqhAhmed-MSFT 49,331 Reputation points Microsoft Employee Moderator

2024-03-13T08:58:58.3133333+00:00

@Muthu Kumar Thanks for the update. This ticket - 2403120030003178 is with different team. Let's wait for them to respond.

1 answer

Your answer

Muthu Kumar 0 Reputation points

2024-03-12T10:51:27.85+00:00

Hi Team,

Thanks for faster response.

Understand from support engineer our subscription is in dormant state currently.

we have tried to login using entra ID, which we never used earlier, tried password reset but, our 2FA settings is showing different phone no and auth app which we never setup up.

Open up another ticket : 2403120030003178 to help reset 2FA and enable only email method, which is linked to our subscription.

Please re-enable our subscription earlier or remove dormant state to allow us to move to another subscription.

Regards.
SadiqhAhmed-MSFT 49,331 Reputation points Microsoft Employee Moderator

2024-03-13T08:58:58.3133333+00:00

@Muthu Kumar Thanks for the update. This ticket - 2403120030003178 is with different team. Let's wait for them to respond.

Answer 1

SadiqhAhmed-MSFT 49,331 Microsoft Employee Moderator

Hello @Muthu Kumar Thank you for reaching out to us on Microsoft Q&A platform. Sorry for the inconvenience this must have caused you!

Based on the details provided, I understand that your subscription is billed beyond your regular usage (compared to previous months) and you noticed some suspicious activity (2 VMs running) that were not used by you.

For this situation, I strongly recommend you contact Azure billing and subscription management support by creating a support ticket. Because your Azure account needs to be reviewed and billing validation has to be performed. The ticket enables you to work closely with the support engineers and get a quick resolution to your issue.

Here is the link - https://docs.microsoft.com/en-us/azure/azure-portal/supportability/how-to-create-azure-support-request to create support case.

FYI: Azure Billing and Subscription Management support is included in the Basic Support Plan without any charge.

https://azure.microsoft.com/en-us/support/plans/

Hope this helps!

If the response helped, do "Accept Answer" and up-vote it

Muthu Kumar 0 Reputation points

2024-03-06T13:24:23.7066667+00:00
Hi Sadiqh,

I am not able submit any support request currently. I have reached out to support with my another subscription.

They have asked me to :

Reset password - done

Reenable 2FA - done

update contact information- done

Enable Service health monitor - cant reach this page.

Waiting for Azure team to enable account.

Regards
SadiqhAhmed-MSFT 49,331 Reputation points Microsoft Employee Moderator

2024-03-06T13:29:04.5+00:00

@Muthu Kumar "Waiting for Azure team to enable account."

You mean the account is disabled?

Can you share the support request # with us?
Muthu Kumar 0 Reputation points

2024-03-06T23:09:51.2433333+00:00

hi Sadiqh,,

support ticket no as requested : 2403060030000960

Regards.
SadiqhAhmed-MSFT 49,331 Reputation points Microsoft Employee Moderator

2024-03-07T09:51:43.8566667+00:00

@Muthu Kumar Thanks for sharing the support request #. It is mentioned that the engineer has sent you secure steps for account secure. Did you follow the steps? If yes, and still facing the same issue, then please report it to the engineer assigned to the support ticket by replying to the email.

Let us know how it goes!
Muthu Kumar 0 Reputation points

2024-03-12T04:26:06.26+00:00

hi Sadiq,

My support engineer is following up, but still i don't have access to my subscription, we need to restore service to our customers.

Hope you can understand our situation, much appreciate if we resolve the issue earlier.

Regards.
SadiqhAhmed-MSFT 49,331 Reputation points Microsoft Employee Moderator

2024-03-12T09:26:31.2466667+00:00

@Muthu Kumar As per support professional the security team is still investigation the issue. It will take some time to restore your account access.

Share via

Azure account compromised

1 answer

Your answer