Microsoft Exchange Hafnium breach is turning into one of the ugliest security incidents ever, really fast. Here I will try to explain my steps in the process, and what my stages of investigation were (so far). If you already know about problem, I will be happy to share some new info and also learn something new from you.

Updated 10 March 2021 – with new info about scripts and link to website check if you were breached (at the bottom of the post).

Updated 11 March 2021 – Looks like CompareExchangeHashes.ps1 script works ok now.

Updated 11 March 2021 – I see a lot of skepticism howt to proceed further with this – here I can offer my observations/opinions – https://www.informaticar.net/what-to-do-if-you-were-breached-by-hafnium-exchange-breach/