Microsoft Security Failings Enabled Major Hospital Ransomware Attack

Senator Ron Wyden is pressing the Federal Trade Commission to investigate Microsoft over what he terms its “gross cybersecurity negligence,” asserting that inherent weaknesses in Microsoft’s security framework enabled a damaging ransomware attack on a hospital system. Wyden’s letter, dated 10 September 2025, identifies how default encryption settings and flawed user-interface design played pivotal roles in the infiltration of Ascension, one of the largest non-profit health systems in the United States.

Wyden’s analysis traces the breach to a contractor who unwittingly clicked on a malicious link surfaced via Microsoft’s Bing search engine. This act set off a chain reaction, with attackers exploiting the obsolete RC4 encryption protocol—still enabled by default on Windows machines—to escalate privileges and penetrate Ascension’s network. The attack disrupted critical hospital operations, forced postponement of surgeries and procedures, and compromised data of more than 5 million patients.

This move by Wyden sharpens the spotlight on Microsoft’s default security posture, particularly its “insecure encryption protocol still activated by default”, which he argues constitutes a failure to uphold proper cyber-defensive standards. He demands the FTC examine whether such design choices amount to a breach of consumer protection obligations and if Microsoft should be held accountable for harm resulting from its software’s insecure defaults.

The senator’s call for an inquiry follows growing scrutiny of Microsoft’s broader security record, including concerns over product bundling and prior calls for review over its handling of software vulnerabilities. The outcome of this push could mark a pivotal moment in how responsibility for cybersecurity failures is allocated between software providers and end-user institutions—a development with profound implications for the industry as a whole.

Wyden’s headline demand—“Microsoft Security Failings Enabled Major Hospital Ransomware Attack”—casts the company not as a passive provider of tools but as one whose systemic design decisions may have amplified cyber-risk. He urges the FTC to assess whether Microsoft’s practices meet the duty of care expected of major technology firms whose platforms underpin critical infrastructure.

With millions of individuals affected and health-care operations disrupted, the stakes are high. Should the FTC launch an investigation, it may set a precedent in assessing corporate responsibility for embedded cybersecurity defaults.