Zoom-Bombing (Apr 2020): What It Taught Us About Teams Meeting Security

Retrospective: this article looks back at events from April 2020, written in 2026 with the benefit of hindsight.

In early 2020, as remote work exploded, "Zoom-bombing" entered the vocabulary: uninvited people joined online meetings and classrooms to disrupt them with offensive content. The FBI issued warnings, and schools and companies scrambled to change settings.

What happened

Meeting links and IDs were posted publicly on social media, guessed or shared beyond the intended audience. Default settings at the time often allowed anyone with the link to join without a password or waiting room. Disruptions ranged from pranks to harassment, and in some cases sensitive business discussions may have been overheard.

The response

Zoom changed defaults quickly — passwords and waiting rooms on by default — and launched a 90-day security improvement plan. Other platforms, including Microsoft Teams, reviewed their meeting controls. Organizations learned that the security of a meeting depends heavily on settings most users never look at.

Why it matters for Teams

Microsoft Teams meetings have similar controls: who can bypass the lobby, who can present, whether anonymous users can join, and whether external participants can record or chat. Defaults favor ease of use. For sensitive meetings — board discussions, M&A, HR — those defaults may not be appropriate.

Lessons in hindsight

• Meeting settings are security settings. Review defaults centrally.
• Different meetings need different policies. Use meeting templates and sensitivity labels for confidential meetings.
• Don't share links publicly for internal meetings.
• Train organizers on lobby and presenter controls.

Zoom-bombing faded as defaults improved, but the core lesson remains: collaboration tools became critical business infrastructure, and their configuration deserves the same attention as email.