Security researchers and other analysts say the attack raises serious questions about the security of Microsoft products and whether the company is employing the same practices internally that it demands of customers.

Beginning in late November, the attackers used a password-spray attack to gain access to Microsoft’s environment. The attacks were not discovered until Jan. 12, and Microsoft said the attackers were seeking to find out what information Microsoft had on Midnight Blizzard.

Adam Meyers, SVP of counter adversary operations at CrowdStrike, noted that Microsoft has been the subject of serious attacks involving its cloud environment in recent years. This includes last year’s hack involving thousands of emails at the U.S. State Department and the Department of Commerce.

“I can tell you as somebody who works at a security company, our executives do not reside on legacy tenants with no multifactor authentication,” Meyers said.

Microsoft, in a blog post on Friday, admitted that it needs to rapidly update its internal security practices after it announced the Secure Future Initiative in November.

“We will act immediately to apply our current security standards to Microsoft-owned legacy systems and internal business processes, even when these changes might cause disruption to existing business practices,” the company said in the blog post.