US Senator Ron Wyden has called on the Federal Trade Commission (FTC) to investigate Microsoft for what he calls “gross negligence in cybersecurity,” accusing the tech giant of knowingly distributing its Windows operating system with a dangerously outdated form of encryption (RC4) that has enabled devastating ransomware attacks on critical US infrastructure, including major healthcare systems.
See also: FTC: Withdraws from Activision Blizzard acquisition case by Microsoft
In a letter addressed to FTC Chairman Andrew N. Fergusonon September 10, 2025, Senator Wyden argued that Microsoft's insecure default settings have created a fertile ground for cybercriminals, directly threatening U.S. national security.
The letter highlights a hacking technique known as “Kerberoasting,” which exploits Microsoft’s continued support for RC4, an outdated encryption technology developed in the 1980s .While modern and secure encryption standards such as the Advanced Encryption Standard (AES), Microsoft has not made them a default requirement in its widely used Active Directory .
The letter describes a 2024 ransomware attack on Ascension, one of the largest nonprofit health systems in the United States, as a prime example of Microsoft’s alleged failures. The incident began when a contractor clicked on a malicious link from a Microsoft Bing search result, unwittingly downloading malware. From this single point of entry, the hackers moved into Ascension’s network and used the Kerberosting technique to exploit weak RC4 encryption on the Microsoft Active Directory . This allowed them to gain administrative privileges, deploy ransomware to thousands of computers, and steal sensitive data from 5.6 million patients. The attack severely disrupted Ascension’s ability to provide patient care.
See also: FTC: Americans lost $12.5 billion to fraud in 2024
Senator Wyden’s office said it had urged senior Microsoft officials in July 2024 to issue clear warnings about the threat posed by Kerberosting. In response, Microsoft published a highly technical blog post in October 2024, suggesting mitigation steps and promising a future software update to disable the vulnerable encryption . However, Wyden criticized the company’s disclosure as inadequate, noting that it was posted in an obscure area of its website without meaningful publicity. Furthermore, eleven months later, the promised security update has yet to be released, leaving countless organizations vulnerable.
The Senator pointed out the hypocrisy of Microsoft’s inaction, as US cybersecurity agencies, including CISA, FBI and NSA, have issued public guidance specifically warning against Kerberosting and advising against disabling RC4 encryption. A comprehensive guide from CISA and NSA, compiled by Australian national security agencies in September 2024, identified Kerberosting as the top threat to Microsoft’s Active Directory software.
See also: FTC sends $25.5 million to victims of tech support scams
Wyden also cited a report by the Cyber Safety Review Board that found Microsoft’s security culture to be “deficient and requires review,” a finding that followed a major breach of U.S. government services by China in July 2023. The senator concluded by accusing Microsoft of profiting from its own insecure products by selling additional cybersecurity services, comparing the company to “an arsonist selling firefighting services to his victims.” He urged the FTC to take immediate action to hold Microsoft accountable for its monopolistic and negligent practices.
