Mimecast, a cybersecurity that helps thousands of organizations worldwide secure email, restore trust and build cyber resilience, disclosed a security incident on Jan. 12, warning customers that a “sophisticated” group of hackers had obtained one of its digital certificates and misused it to gain access to customers’ Microsoft 365 accounts. The London-based company said the certificate in question was used by many of products to connect to Microsoft’s infrastructure.
Among the products that used this certificate are the Mimecast Sync and Recover, Continuity Monitor, and IEP, according to what the company said in a related publication shared on site .
Mimecast noted that about 10% of its customers use the affected products with this specific certificate. However, the «advanced» hackers misused the stolen certificate to gain access to only a few Microsoft 365 accounts of those customers.
According to ZDNet, the company estimates that the number of these accounts does not exceed 10, describing it as a “low single-digit number,” also adding that it has already contacted all affected customers.
To prevent possible future abuse, the company now asks all its customers to immediately delete the existing connection to their Microsoft 365 tenant and proceed with a new certificate-based connection using the new certificate that is available.
Furthermore, Mimecast reported that it is currently working with a third-party expert, Microsoft, and law enforcement, to investigate how this security incident occurred, and what consequences it may entail.
The company stated that it was informed about the incident by Microsoft, after the tech giant detected unauthorized access to certain accounts.
There are speculations that this security incident may be linked to the recent SolarWinds, but a Mimecast spokesperson declined to comment on the matter.
