A security flaw in Microsoft’s cloud product left thousands of its customers’ databases vulnerable to attack, according to threat researchers at cloud security startup Wiz.

Wiz, a newly minted cybersecurity unicorn founded by the team that built Microsoft Azure’s cloud security stack, detailed the “unprecedented breach” in a blog post late yesterday. Its threat hunting team discovered flaws in Azure Cosmos DB that allowed any user to download, delete, or change sensitive information in several thousand Azure customers’ commercial databases. They named the vulnerability “#ChaosDB,” and noted: “Exploiting it was trivial and required no other credentials.”

This is a big deal because the world’s largest companies use the cloud database product. Cosmos DB customers include Coca-Cola, Safeway, Johnson Controls, ExxonMobil, Skype, and Rolls-Royce. And Wiz said the vulnerability gave its threat hunters “complete unrestricted access” to customer accounts and databases, including many Fortune 500 companies.

Wiz, however, did credit Microsoft with rapidly fixing the problem. “We rarely see security teams move so fast! They disabled the vulnerable notebook feature within 48 hours after we reported it,” Wiz threat hunters Nir Ohfeld and Sagi Tzadik wrote. “It’s still turned off for all customers pending a security redesign.”

In an email to SDxCentral, a Microsoft spokesperson said the cloud giant notified customers about the vulnerability, and it isn’t aware of cyberattackers using this technique and accessing any customer data. “We fixed the issue immediately to keep our customers safe and protected,” the spokesperson said in an email. “We thank the security researchers for working under Coordinated Vulnerability Disclosure.”

Later during the day, Microsoft's security team posted its own blog about the vulnerability.

Microsoft also agreed to pay Wiz $40,000 for finding the flaw and reporting it, according to Reuters, which broke the story on Thursday night.

Although attackers didn’t exploit the Cosmos DB bug, this latest security incident follows a series of high-profile breaches including SolarWinds, Microsoft Exchange, and PrintNightmare, in which hackers did gain access to customer networks and data.

Additionally, earlier this month, threat researchers at Huntress warned that attackers were actively exploiting ProxyShell vulnerabilities to access Exchange servers. The U.S. Cybersecurity and Infrastructure Agency echoed this warning and said it posed an urgent threat. Microsoft finally this week posted a security advisory about the ProxyShell vulnerabilities, urging customers to update their systems before attackers use the unpatched Exchange servers “to deploy ransomware or conduct other post-exploitation activities.”

This latest security flaw “should be an embarrassment for Microsoft as Cosmos is the central database of Azure exposing all of its customers,” Zeus Kerravala, principal analyst at ZK Research, wrote in response to questions. “Given the spotty track record Microsoft has had in recent history with this, SolarWinds, Exchange, and others, I'm advising customers to be wary of using Microsoft and to use AWS and or GCP instead.”

Meanwhile, Microsoft should do a “complete rethink of security,” because its current strategy isn’t working, Kerravala added, noting its $40,000 payout to Wiz for finding the flaw. “It wouldn’t be a bad idea to offer some much bigger incentives to organizations that can find and report vulnerabilities across all its products,” he wrote. “This will put more eyeballs on more products and help Microsoft proactively fix issues.”

In its most recent bug bounty report, Microsoft said it paid out $13.6 million this year to security researchers that found and reported software vulnerabilities in its products. The largest single award totaled $200,000, and the average award hovered around $10,000.