A Microsoft spokesperson declined to say which source code the hackers viewed. Source code shows how computer programs work and is used to build products. Gaining access to such code could have given the hackers valuable insight into how they might exploit programs or evade detection. Microsoft said its security philosophy, or “threat model,” anticipates that its source code will be viewed, and that defenses are built with that in mind.

Microsoft had previously said it, too, had received a malicious update of software from information technology provider SolarWinds Corp. that was used to breach government agencies and companies around the world. The details of the campaign are still largely unknown, including how many organizations were victimized and what was taken by the hackers. Bloomberg News reported in December that investigators have determined at least 200 organizations were attacked as part of the campaign.

Microsoft said the hackers didn’t use the SolarWinds update to reach the internal account, but declined to elaborate on exactly how the attackers gained access. The company also didn’t specify in the blog post which code repositories were accessed, nor how long the hackers were inside the company’s network, but reiterated that there is no indication its systems were used to attack others.

“This activity has not put at risk the security of our services or any customer data, but we want to be transparent and share what we’re learning as we combat what we believe is a very sophisticated nation-state…