2021 World Events · Pandemic shock, supply-chain compromise, and high-intensity war
Microsoft Exchange Hafnium campaign
Attackers exploited Microsoft Exchange Server vulnerabilities at scale before patches were widely applied.
Evidence-led reading
What is stated, why it matters, and what remains uncertain
What this is
A specific-event record selected from the protected World Events source ledger for cross-year research. It is not an exhaustive account of 2021.
Why it matters
It showed the strategic value of mass exploitation against enterprise email infrastructure.
What is established here
The page faithfully exposes the submitted record and its source boundary. No claim-level evidence packet has yet upgraded the record beyond a research starting point.
What remains uncertain
Starting-point source from the submitted dataset; verify exact dates, attribution, legal posture, casualty figures, and current status before reuse.
Record narrative
Source-bounded summary
Attackers exploited Microsoft Exchange Server vulnerabilities at scale before patches were widely applied.
It showed the strategic value of mass exploitation against enterprise email infrastructure.
Structured fields
Record at a glance
- Stable record ID
- 2021-003
- Date or period
- 2021-03
- Type
- Cyber espionage / exploitation
- Focus
- Cyber / espionage
- Impact scope
- Global
- Priority
- 5 of 5
- Location label
- Global cyberspace, Global
- Coordinate precision
- Cyberspace: no single coordinate
- Actors named by the source record
- Chinese state-linked actors attributed; Microsoft Exchange users
- Verification state
- source-start-point; sensitive details require independent verification
Geographic context
A coordinate locator, not a surveyed event footprint
No supportable coordinate is supplied for this record. The location label remains descriptive rather than geospatial.
Review location and coordinate boundariesSource and verification boundary
This remains a starting-point record
Starting-point source from the submitted dataset; verify exact dates, attribution, legal posture, casualty figures, and current status before reuse.
Citation and correction
Use the stable record ID and challenge individual propositions
A correction may concern the date, place, actors, attribution, legal status, figures, coordinate precision, source characterization, or why-pivotal summary without invalidating every other field.
2IA — International Intelligence Archive. “Microsoft Exchange Hafnium campaign.” World Events record 2021-003. Reviewed July 27, 2026. https://2ix.org/world-events/2021/2021-003/