HIPAA

Cybersecurity News Security Advisory

Microsoft 365 Copilot Defect Exposes AI Summarizes of Confidential Emails

Microsoft 365 Copilot Vulnerability Bypasses DLP Policies, Summarizes Confidential Emails; Bug Tracked CW1226324

Summary :

A recently disclosed issue in Microsoft 365 Copilot caused the AI assistant to summarize confidential emails despite sensitivity labels and Data Loss Prevention (DLP) policies being configured. 

The bug, tracked under CW1226324, allowed Copilot’s “Work Tab” chat feature to process and summarize emails from Sent Items and Draft folders, even when those emails carried confidentiality labels designed to restrict automated access. 

Microsoft findings

Microsoft’s investigation revealed a code-level defect as the root cause. The flaw allows Copilot to inadvertently pick up items stored in users’ Sent Items and Draft folders, bypassing the confidentiality labels applied to those messages.

Although Microsoft categorized the issue as an advisory with potentially limited scope, the incident raises significant concerns regarding AI governance, trust boundaries, and enterprise data protection controls.

As per CSN the flaw allows Copilot to inadvertently pick up items stored in users’ Sent Items and Draft folders, ignoring the confidentiality labels applied to those messages.

Vulnerability Details 

The issue happened because of an internal coding mistake in Microsoft 365 Copilot’s Work Tab chat feature. Due to this error, Copilot was able to access emails stored in Sent and Draft folders, even if they were marked as confidential. 

In normal conditions, sensitivity labels and DLP policies should block automated tools from processing such emails.

However, because of this flaw, Copilot treated those protected emails as regular content and created summaries from them until Microsoft began deploying a fix in February 2026. 

Attack Flow 

Step Description 
Configuration Organization applies confidentiality labels and DLP policies to sensitive emails. 
Storage Emails are stored in Sent Items or Draft folders. 
Trigger User interacts with Copilot “Work Tab” Chat. 
Processing Due to the code bug, Copilot accesses labeled emails. 
Exposure Copilot generates summaries of confidential content, bypassing expected DLP enforcement. 

Source:0din 

Why It’s Effective 

  • DLP Control Bypass: AI processing occurred despite policy enforcement. 
  • Trust Boundary Violation: Copilot acted as a privileged internal processor without honoring classification restrictions. 
  • Compliance Risk: Potential regulatory implications under GDPR, HIPAA, ISO 27001, and industry frameworks. 
  • AI Governance Gap: Demonstrates that AI systems must be independently validated against traditional security controls. 

Broader Implications 

This issue shows that AI tools inside business software can sometimes ignore security rules, even when protection like DLP and sensitivity labels are properly set. It proves that AI systems can create new risk areas that traditional security controls may not fully cover. 

As more companies use AI assistants in daily work, security teams must regularly test and monitor how AI handles sensitive data. AI should be treated like a powerful internal system that needs strict oversight, not just a simple productivity feature. 

Remediation: 

Microsoft has initiated a fixed rollout and is monitoring deployment progress. However, organizations should take proactive measures: 

  • Validate that sensitivity labels are now properly enforced with Copilot. 
  • Audit Copilot usage logs and AI interaction history. 
  • Re-test DLP enforcement across Sent and Draft folders. 
  • Update AI governance documentation and risk registers. 
  • Conduct tabletop exercises covering AI-driven data exposure scenarios. 

Conclusion: 
This incident highlights that AI integrations can introduce unexpected security gaps, even in well-configured enterprise environments. Organizations cannot assume that existing security controls will automatically work the same way with AI-powered features. 

As AI adoption increases, companies must strengthen AI governance, continuously validate security policies, and monitor AI behavior just like any other critical system. Proactive testing and oversight are essential to prevent future data exposure risks. 

Bypassing DLP policies by AI aided assistants signals huge security gap which needs to be addressed at enterprise level as AI tool taking over enterprise security posture cannot be undermined.

References: 

Blogs

Regulations for Start-Ups & SME’s Helps address Cyber Risk & Business Strategy

This decade has witnessed huge technological, digital and cyber security uprise and challenges which shaped the way of doing business and business strategy. Now every company is powered by software and technology and cybersecurity a top priority for organizations everywhere. Regulations are of high importance for business strategy and cyber risks. Startups under the Startup India initiative can self-certify their compliance with labor and environmental laws, reducing the risk of inspections and penalties.

For every start up owners placing their business for long term success is ultimate goal and positioning the business requires set of regulations that can bring both opportunities and challenges. Compliance brings in additional challenge but integrating compliance brings in transparency and subsequent valued positioning for clients who value transparency.

That’s putting a lot of pressure on cybersecurity leaders to level up their governance, risk, and compliance programs. India’s push towards digitization has transformed how businesses interact with regulators and the government has rolled out a range of tax incentives to bolster the growth of startups and SMEs. Further the government has been recognizing the role of innovation in the startup ecosystem and to further this strengthened IP protections.

Sector specific regulations

The government has also taken a proactive approach to sector-specific regulations and this has been for most important sectors from fintech to ecommerce, healthcare etc. Regulatory sandboxes by RBI and SEBI allow fintech startups to test new products in a controlled environment. New draft e-commerce rules aim to ensure transparency, fair competition, and consumer protection.

For emerging vibrant business it is important that business leaders stay abreast to staying abreast new regulatory changes that will help leverage the full potential of upcoming India’s vibrant business landscape.

Prioritizing Cyber security for Business Continuity with Regulations

Recently Akshay Joshi, head of World Economic Forum’s Centre for Cybersecurity highlighted that significant challenges lies in prioritizing cybersecurity and addressing these requires a combination of strong incentives and regulatory support,.

“There needs to be incentives that are brought into the mix for appropriate investments into cybersecurity,” Joshi said, emphasizing that regulation plays a crucial role.

As per WEF’s annual Global Cybersecurity Outlook Report, which found that roughly 70% of respondents agree that regulations are “really effective in terms of ensuring a baseline of cybersecurity.”

(Source: Startups and SMEs need incentives and regulations to prioritise cybersecurity: WEF official | Company Business News)

As startups and SME’s navigate through business challenges and every day there is a fresh rules emerging across industries, understanding their impact on business for CEO’S is crucial for staying ahead. By understanding the different types of regulations, startups can better navigate the landscape for your business.

For every start up owners placing their business for long term success is ultimate goal and positioning the business requires set of regulations that can bring both opportunities and challenges.

Without regulations in place innovation will be stalled and so the fair set up within the ecosystem. In the beginning embracing regulations may be daunting task but regulations play important role for startups specifically cyber security based start ups who are constantly battling warfare’s that is equivalent to cripple critical infrastructure and damage organizations affecting economies at a scale that is equivalent to any physical attack.

For Cyber security Startups any regulatory updates often focus on data privacy, financial practices and data security. For instance, recent data protection laws require companies to enhance their data security measures to safeguard customer data and information, This is done so to foster trust and loyalty among users and increase brand value.

There are Compliance that are driven by regulations and can pose challenges for start ups as this increases operational costs. These changes may demand additional investments in legal counsel or technology to ensure adherence.

If any Startup is handling customer data and if they invest in data protection solutions which is essential to bring in confidence for their customers. With GDPR and CCPA regulations, organizations might face fines for non-compliance and loose trust from investors that may restrict further funding.

Startups that proactively integrate compliance into their core strategy can position themselves as industry leaders, appealing to customers who value transparency.

Conclusion:

Cyber security is every where and is crucial from point of network and cloud security to AI, privacy, governance, forensics, and risk management, each domain plays a crucial role in keeping organizations resilient. For customers it means that their data is in safe hands.

Having a discipline structure and frameworks in place increases brand value.  However, cybercriminals are increasingly focused on targets that have weaker defenses and start ups are prime in their targets.

Any organization who implement regulations, audits certification and follow compliance enhances their defenses.
They might be handling sensitive data, but staying compliant with regulations like GDPR and HIPAA is essential. Regular security audits and employee training can significantly reliability and confidence among investors.

For business to thrive and grow regulations are step ahead towards creativity, innovation and growth,. This helps business to stay ahead of competitors and establish a reputation for innovation, also for avoiding penalties, legal consequences and reputational damage.

Blogs

Recent Health Care Data Breaches Highlight Importance of Proactive Leadership

Recent data breaches on healthcare organisation be it insurance provider to  big hospitals and healthcare organisation witnesses how hackers were able to compromise the protected health information of patients.

Healthcare organisations collect an enormous amount of data and these are not only personal details but includes health insurance details, payment structure and  medical records etc. These information’s are extremely important from financial point and a big lucrative market for hackers to track down and use them for gains.

In 2024 there were 1,160 healthcare related cyber breaches, exposing 305 million patients record out in dark web a marked increase of 26% in 2025.

As of March 19, 2025, 734 large data breaches have been reported to OCR, a percentage decrease of 1.74% from the 747 large healthcare data breaches reported in 2023.

While a reduction in healthcare data breaches is a step in the right direction, 2024 was the worst-ever year in terms of breached healthcare records, which jumped by 64.1% from last year’s record-breaking total to 276,775,457 breached records, or 81.38% of the 2024 population of the United States.

The Star Health Data Breach

Star Health and Allied Insurance is delaing a difficult situation where a potential exodus of top executives following a massive data breaches affecting over 30 million customers.

The breach has led to internal cybersecurity investigations, possible financial penalties up to ₹250 crore and heightened scrutiny over leadership accountability.

Employee attrition is reportedly rising with the organization, especially in tier-2 and tier-3 cities and top it all the reputational damage and operational challenges.

The hacker responsible for a major data breach at Star Health and Allied Insurance last year has reportedly claimed responsibility for sending death threats and bullet cartridges to the insurer’s top executives.

As per reports the hacker reportedly said the recent threats were triggered after being contacted by Star Health policyholders who claimed their legitimate insurance claims were denied.

Star Health, India’s biggest health insurer, has faced criticism from customers and data security experts as per Reuters. Since last September the hacker known by alias name ‘xenZen’ had leaked sensitive client data, including medical reports. At the time, xenZen told Reuters in an email they possessed 7.24 terabytes of data related to over 31 million Star Health customers and was speaking to potential buyers for the data.

This incident brings in light top leadership crisis within the organisation.

Crisis Management is broader perspective that encompasses leadership decisions, communication strategies, stakeholder engagement, business continuity, fiscal management, and long-term reputational considerations.

Healthcare specific Cyber security performance goal(CPGs)

With record numbers of healthcare records being compromised, it is clear that more needs to be done to improve healthcare cybersecurity.

Beginning of 2024, the HHS’ Office for Civil Rights published two sets of healthcare-specific cybersecurity performance goals (CPGs).

In December 2024, the HHS published a long-awaited proposed update to the HIPAA Security Rule that will, if enacted, force healthcare organizations to implement a range of measures to improve their security posture. The proposed update includes some of the recommended measures in the CPGs, such as multifactor authentication, encryption for data at rest and in transit, mitigating known vulnerabilities, network segmentation, maintaining an accurate asset inventory and cyber security testing.

Stable Leadership to deal with un-certainties  of cyber threats

Organisations under stable leadership must undertake a rigorous risk-assessment process that encompasses disaster mitigation. This will include cyber incident recovery and business continuity planning to support the resilience of critical health care functions and systems. 

With strong new leadership companies can adopt bold steps to regain trust by investing heavily in cyber security infrastructure. This is led by launching new products focused on identity protection.

Having a transparent approach in addressing vulnerabilities and commitment to innovation will help restore customer confidence and set a new industry standard for data protection. To turn cybersecurity threats into oppertunites, CEO and CISO’s must embrace a multifaceted leadership approach to deal with advance cyber tactics employed by hackers and cyber criminals.

To go beyond technical solutions and extends to cultural, strategic and operational changes.

Adopting a cyber-security first culture within the Organization

  • First and foremost it is important to foster a security-first culture within an organization is critical. This will involve embedding cyber security considerations into every level of business decision-making.
  • Organisations and top leadership taking decisions from development to customer engagement. Leadership must set the tone by prioritizing security as a fundamental business value .
  • Cyber security training a must within the organisation will help build a culture that requires continuous reinforcement through regular training, internal etc.
  • The next step would be ad frameworks that allow businesses to quickly pivot in response to emerging risks.
  • The next step would be adopting frameworks that will allow business to quickly scale and impose proper response during emergency or any cyber threat.
  • The growing cyber risk is also an opportunity for cyber security leadership to stay ahead of their adversaries by improving certain aspects like involving real time threat visibility, gathering actionable insights from industry partners etc.. This will enable proactive security measures  that is resilient in building a cyber-security strategy . To reduce the after affect of breaches, top leadership must adopt cross-functional collaboration and investing in ongoing education to create a more security-conscious workforce.
  • All in all a proactive cyber security strategy will help organizations and this is possible by embracing innovation and having a transparent and proactive leadership.

A strong leadership will help to mitigate risks and enhance organisations competitive standing in the market. This can be followed by Iidentifing not only technical vulnerabilities but also operational weaknesses, supply chain risks, and human factors or insider threat .

.

Scroll to top