A sophisticated threat actor compromised a Mimecast certificate used to authenticate several of the company’s products to Microsoft 365 Exchange Web Services, Mimecast disclosed Tuesday.
The Lexington, Mass.-based email security vendor said the certificate used to authenticate its Sync and Recover, Continuity Monitor and Internal Email Protect (IEP) products to Microsoft 365 has been compromised. Mimecast said it was recently informed of the compromise by Microsoft.
Mimecast’s stock is down $2.40 per share (4.67 percent) to $49 per share in pre-market trading Tuesday, which is the lowest the company’s stock has traded since Dec. 15. Mimecast declined to answer questions about whether the compromise of its certificate was carried out by the same threat actor who for months injected malicious code into the SolarWinds Orion network monitoring tool.
Approximately 10 percent of Mimecast’s customers use the compromised connection, according to the company. Of those that do, Mimecast said currently indications are that a low-single-digit number of Mimecast customers’ Microsoft 365 tenants were actually targeted. Mimecast said it has already contacted the customers with targeted Microsoft 365 tenants to remediate the issue.
“The security of our customers is always our top priority,” Mimecast said in a statement issued Tuesday morning. “We have engaged a third-party forensics expert to assist in our investigation, and we will work closely with Microsoft and law enforcement as appropriate.”
Mimecast said it’s asking the 10 percent of its customer base