Mimecast admits hackers accessed users’ Microsoft accounts

'Sophisticated' threat actors obtained one of Mimecast's digital certificates and abused it to gain access to clients' accounts

Mimecast has admitted that a number of its users may have their Microsoft 365 accounts accessed by “a sophisticated threat actor”.

The security incident involved hackers obtaining one of Mimecast's digital certificates and abusing it to gain access to clients’ accounts.

The cloud cyber security services provider was alerted about the incident by Microsoft, and the two companies are working with a third-party forensics expert and law enforcement to investigate the breach.

According to Mimecast, “approximately 10%” of its customers used the connection involving the affected certificate, with not more than nine customers believed to be affected by the breach.

“There are indications that a low single digit number of our customers’ M365 tenants were targeted,” the company announced in a blog post, adding that it had “already contacted these customers to remediate the issue”.

Mimecast also advised “customers using this certificate-based connection to immediately delete the existing connection within their M365 tenant and re-establish a new certificate-based connection using the new certificate" that the company had "made available”.

The London-based company said that taking this precaution would “not impact inbound or outbound mail flow or associated security scanning”.

The news comes days after it was revealed that the cyber criminals who compromised SolarWinds in a sophisticated supply chain cyber attack broke into Microsoft and accessed the company’s  source code repositories.

However, it was also confirmed that the attackers, linked by US authorities to the Russian state, didn’t alter the codebase at the heart of Microsoft's core products and services. They did so through an internal account that had permissions to view, but not edit, these repositories.

Mimecast also made headlines last year when its Threat Center researchers discovered a rise in LimeRAT malware delivery using Microsoft Excel’s “VelvetSweatshop” default password. The research team found making an Excel file read-only instead of locking it encrypts the file without needing an externally created password to open it.

For some time, hackers had taken advantage of how Excel’s encryption and decryption processes work to distribute malware, Mimecast said at the time.

Featured Resources

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Evaluate your order-to-cash process

15 recommended metrics to benchmark your O2C operations

Download now

AI 360: Hold, fold, or double down?

How AI can benefit your business

Download now

Getting started with Azure Red Hat OpenShift

A developer’s guide to improving application building and deployment capabilities

Download now

Recommended

Best ransomware removal tools
ransomware

Best ransomware removal tools

22 Jan 2021
Hackers publish over 4,000 files stolen from SEPA in ransomware attack
Security

Hackers publish over 4,000 files stolen from SEPA in ransomware attack

22 Jan 2021
Weekly threat roundup: SAP, Windows 10, Chrome
vulnerability

Weekly threat roundup: SAP, Windows 10, Chrome

21 Jan 2021
Biden nominees highlight tough cyber security challenges
cyber security

Biden nominees highlight tough cyber security challenges

20 Jan 2021

Most Popular

School laptops sent by government arrive loaded with malware
malware

School laptops sent by government arrive loaded with malware

21 Jan 2021
How to move Windows 10 from your old hard drive to SSD
operating systems

How to move Windows 10 from your old hard drive to SSD

21 Jan 2021
What is the Raspberry Pi Pico?
Hardware

What is the Raspberry Pi Pico?

21 Jan 2021