MSFTMicrosoft

Please advise us as to why you determined to file under Item 1.05 of Form 8-K given the statement that the incident had not had a material impact on your operations, and you had not determined whether the incident was reasonably likely to materially impact your financial condition or results of operations.

On January 12, 2024, we detected that beginning in late November 2023, a nation-state associated threat actor had gained access to Microsoft’s employees’ email accounts and exfiltrated sensitive business and other information. At the time of filing the Form 8-K, our investigation was ongoing and many aspects of the situation were uncertain. Based on the information in our possession at that time, we considered potential impacts of the incident, including those identified in the Gerding Statement (defined below).

Rest of the answer

Although we were generally aware that a large volume of data had been accessed, we did not believe there to be and were unable to determine any material impact of the incident applying both qualitative and quantitative factors. Nevertheless, due to the uncertainty and ongoing investigation and remediation of this significant and complex incident, and noting the SEC’s admonition in both the proposing and adopting release that “doubts as to the critical nature” of the relevant information “be resolved in favor of those the statute is designed to protect,” we determined that prompt disclosure of the incident under Item 1.05 of Form 8-K was warranted. The Form 8-K provided investors with information necessary to understand the material aspects of the nature, scope, and timing of the incident. The Form 8-K/A provided investors with information related to developments in the incident since the filing of the Form 8-K, and to update prior statements that our investors, customers, and other stakeholders may have been relying upon.

We continue to actively monitor and update our assessment of this cybersecurity incident through our incident review process. To the extent we determine that the incident has or is reasonably likely to materially impact the Company, including our financial condition or results of operations, we will file an amended Form 8-K pursuant to Instruction 2 of Item 1.05 to update our disclosure.

On May 21, 2024, Erik Gerding, Director, Division of Corporation Finance released a statement related to disclosure of cybersecurity incidents determined to be material and other cybersecurity incidents (the “Gerding Statement”). We acknowledge the Gerding Statement and will give the Gerding Statement appropriate consideration when evaluating future cybersecurity incidents and Form 8-K disclosure.

Read in the reply ↗

We note the statement in your Form 10-Q for the quarter ended March 31, 2024 indicating that the cybersecurity incident has and may continue to result in harm to your reputation and customer relationships. Please advise us as to whether you believe the harm to your reputation and customer relationships is reasonably likely to have a material impact on you, including your financial condition and results of

Rest of the question

operations. To the extent you determine it is reasonably likely to have a material impact, please file an amended Form 8-K pursuant to Instruction 2 to Item 1.05 to update your disclosure.

As of the date of this response letter, we do not believe the harm to our reputation and customer relationships is reasonably likely to have a material impact on the Company, including our financial condition and results of operations. We continue to actively monitor and update our assessment of this cybersecurity incident through our incident review process.

Rest of the answer

To the extent we determine that the harm to our reputation and customer relationships is reasonably likely to have a material impact on the Company, we will file an amended Form 8-K pursuant to Instruction 2 of Item 1.05 to update our disclosure.

*****

Please advise us if we can provide any further information or assistance to facilitate your review. Please direct any questions or further comments regarding this response letter to the undersigned at (425) 882-8080.

Read in the reply ↗