U.S. Senator Ron Wyden (D-Ore.) has formally requested the Federal Trade Commission (FTC) open an investigation into Microsoft, arguing that the tech giant’s cyber-security practices amount to “gross negligence” and pose a serious national security risk. In a September 10, 2025 letter to FTC Chair Andrew Ferguson, Wyden accuses Microsoft of delivering “dangerous, insecure software” to the U.S. government and critical infrastructure sectors, especially healthcare. Central to his concerns are default insecure settings in Windows, continued support for the outdated RC4 encryption standard, and failure to require long enough passwords for privileged accounts—factors which he alleges enabled the 2024 ransomware attack on Ascension Healthcare, affecting 5.6 million patients. Wyden also criticizes Microsoft for not promptly disabling RC4, for providing guidance in overly technical language to a small audience rather than broadly warning its users, and for profiting from cybersecurity add-ons while its core software remains vulnerable. Microsoft has responded that RC4 usage is minimal (under 0.1% of traffic), that disabling it completely risks compatibility breaks, and that it plans to disable RC4 by default in certain Windows Server 2025 installations in early 2026; meanwhile mitigation for existing systems will be added.
Sources: Office of US Sen. Ron Wyden, IT Pro, CyberScoop
Key Takeaways
– Outdated defaults matter: Microsoft’s default configurations, including support for the RC4 encryption protocol and insufficiently strong password policies for privileged accounts, are central to Senator Wyden’s argument that the company’s product security posture is leaving critical infrastructure vulnerable.
– Real-world consequences: The 2024 ransomware incident at Ascension Healthcare is cited as a concrete example illustrating how weak defaults, combined with phishing via Microsoft’s services (Bing/Edge), allowed attackers to gain privileged access and compromise patient data.
– Regulatory scrutiny and response timeline: Wyden is pushing the FTC to hold Microsoft accountable; Microsoft has committed to disabling RC4 by default in certain new server setups by early 2026, but critics argue the pace and communication have been too slow and that broader mitigation is still needed.
In-Depth
Senator Ron Wyden has escalated his criticism of Microsoft, demanding that the Federal Trade Commission (FTC) investigate what he describes as “gross cybersecurity negligence.” His September 2025 letter argues that Microsoft’s long-standing default settings, engineering choices, and slow movement away from obsolete encryption standards have created exploitable gaps in critical infrastructure defenses—primarily in healthcare—but also affecting government systems broadly.
According to Wyden, Microsoft’s software design, especially its defaults and support for antiquated protocols like RC4, have enabled serious threats, including the 2024 ransomware breach at Ascension Healthcare, which resulted in the exposure of sensitive data for 5.6 million patients after a contractor unintentionally introduced malware via a malicious Bing search link.
The senator’s central contention is that Microsoft, by not making more secure configurations the default, shifts the burden of security onto customers—many of whom lack the technical bandwidth to audit, change, or maintain hardened settings. Wyden argues this dynamic is especially problematic given Microsoft’s de facto dominance in enterprise operating systems and identity management tools like Active Directory.
In his view, when one entity controls so much of the architecture, its choices about defaults, encryption, and backwards compatibility ripple outward, influencing systemic risk. To this point, Wyden highlights Kerberoasting—an attack that abuses weak or legacy encryption in Kerberos ticketing systems—together with weak password requirements, as vectors that remain open because Microsoft hasn’t required usage of stronger encryption (e.g. AES) or eliminated RC4 broadly and more rapidly.
Microsoft, in turn, defends its position by noting that RC4 is rarely used in practice (under 0.1% of traffic), that removing or disabling it entirely risks breaking compatibility with existing systems, and that the company has placed on its roadmap the phasing out of RC4 and other mitigations. It also points out that, technically, organizations can choose stronger settings—it’s just not the default. Nonetheless, Wyden contends that merely offering the possibility of stronger security, without making it standard, is insufficient given real consequences of weak settings: compromised networks, stolen data, and disruption of public health services.
As this debate unfolds, the questions are not simply whether Microsoft’s engineering roadmap is improving, but whether regulatory bodies like the FTC should intervene to shift incentives, enforce more secure defaults, and hold dominant platform providers to greater responsibility for the downstream risks of their software engineering decisions.