I'm suffering an attack in Azure.

Question

Early this morning, I noticed an unusually high charge on my billing statement. Upon investigating, I found out that a large number of VMs and other resources had been unexpectedly created under my account. I attempted to delete and stop these resources, but my administrative privileges were immediately revoked, preventing any further actions. Now, it's crucial that I report this incident so the subscription can either be canceled or appropriate measures can be taken. Additionally, I want to point out that Azure lacks a direct reporting channel for such security issues. The only available option is to create tickets related to billing, which does not offer a swift response to potential security breaches. This lack of immediate support can be detrimental for all parties involved.

Answer 1

Hi Vickry Santana,

Thanks for reaching out to Microsoft Q&A.

In this case I would suggest you first get all the billing details clarified and then reach out to vulnerability team for your security related incident. Billing support request via Azure portal is free for all Azure customers and doesn't require a paid support plan. Please select 'Billing' under 'issue type' while creating the support request.

https://azure.microsoft.com/en-in/support/create-ticket

Report security related incident

https://msrc.microsoft.com/report/vulnerability/new

Use the Get Help app here to chat online

https://support.microsoft.com/ContactUs

If you think your account has been compromised and need to be recovered

https://support.microsoft.com/en-us/account-billing/help-with-the-microsoft-account-recovery-form-b19c02d1-a782-dee6-93c3-dc8113b20c42

Also, I would advise you review security service offerings from Microsoft Defender for Cloud to help improve your security.

Let me know if you need any other help

Please 'Upvote'(Thumbs-up) and 'Accept' as an answer if the reply was helpful. This will benefit other community members who face the same issue.