Senator Wyden Calls for FTC Investigation into Microsoft Over Cybersecurity Negligence Linked to Ransomware Attacks
September 11, 2025
U.S. Senator Ron Wyden has formally requested the Federal Trade Commission (FTC) to investigate Microsoft, alleging severe cybersecurity negligence that has facilitated ransomware assaults on critical U.S. infrastructure, notably in the healthcare sector. In a detailed four-page correspondence to FTC Chairman Andrew Ferguson, Wyden characterized Microsoft’s actions as emblematic of “gross cybersecurity negligence,” suggesting that the company’s significant share of the enterprise operating system market exacerbates the risks associated with its cybersecurity practices.
Wyden’s appeal comes on the heels of alarming revelations from Ascension, a major healthcare system that experienced a debilitating ransomware attack last year. This incident resulted in the compromise of personal and medical records for approximately 5.6 million individuals, underscoring the gravity of the threats faced by critical infrastructure entities. The senator drew a striking analogy, portraying Microsoft as an “arsonist selling firefighting services to their victims,” emphasizing the potential calamitous consequences of ongoing vulnerabilities within the software giant’s systems.
The vulnerabilities highlighted originate from alleged systemic lapses in Microsoft’s cybersecurity framework. Wyden pointed to the company’s culture of negligence as a primary factor contributing to the increasing prevalence of ransomware attacks. The attacks on crucial sectors, particularly healthcare, raise significant national security concerns, particularly when considering that timely intervention may mitigate further breaches.
In terms of the tactics employed during these ransomware breaches, various techniques from the MITRE ATT&CK framework can be identified. Initial access is often gained through phishing campaigns or exploiting known vulnerabilities within widely used software. Once adversaries infiltrate the system, techniques such as privilege escalation may allow them to move laterally within the network, enhancing their control and ability to deploy ransomware effectively. The persistence of these threat actors is often maintained through backdoors and other means, ultimately complicating eradication efforts.
This call to action from Wyden is part of a broader trend of heightened scrutiny on major technology providers regarding their role in public cybersecurity. With the stakes rising, business owners and stakeholders across various sectors are advised to assess their own cybersecurity measures, especially those reliant on widely adopted enterprise systems. The implications of the current discourse surrounding Microsoft serve as a stark reminder of the pressing need for robust cybersecurity protocols to guard against evolving threats.
As the FTC considers the investigation, the outcome could set important precedents regarding corporate responsibility in cybersecurity practices. The tech industry and those who depend on its infrastructure would do well to monitor developments closely, ensuring that their own defenses remain fortified against the risks posed by both direct attacks and the ramifications of negligent practices in the sector.