Mimecast Certificate Compromise (2021)

Mimecast is a cloud email security vendor whose integration into Microsoft 365 relies on vendor-issued certificates for authentication.

Discovery. The incident surfaced in 2021 after unusual activity was identified in the vendor's environment.

Investigation. External forensics confirmed unauthorised access affecting Microsoft 365 integration.

Notification. Downstream customers were notified and required to review their own exposure.

• Attackers gained access to the vendor environment holding Microsoft 365 integration.
• Credential, token or software supply chain compromise was central to the intrusion path.
• Downstream customers had limited visibility into vendor internal controls.
• Detection was delayed relative to the exposure window.

• Vendor was under-classified. Data classification did not reflect the volume or sensitivity of Microsoft 365 integration.
• Concentration risk was invisible. One vendor served many customers in the same sector.
• Contractual controls were weak. Notification, forensic access and evidence rights were vendor-favourable.
• Downstream visibility was absent. Customers could not see the vendor environment where their data lived.

• Downstream customers issued notifications to their end users.
• Regulators reviewed the incident under relevant data protection and sector rules.
• Contract renegotiations followed for affected vendor relationships.

The Mimecast incident became a reference point in TPRM programmes for email security vendor, driving stronger classification, contractual and monitoring controls across the sector.

The customers who used Mimecast did not have a technical failure. They had a trust failure. They trusted the vendor to hold Microsoft 365 integration without ever verifying how.

1. Classify email security vendor as tier-1 by default when they hold Microsoft 365 integration.
2. Demand contractual notification within hours, not days.
3. Require independent forensic reports for material incidents.
4. Rotate credentials, tokens and keys after any vendor breach.
5. Segment vendor tenants and least-privilege every integration.
6. Map concentration risk across the sector.
7. Rehearse downstream customer notification with legal and comms.
8. Report vendor incident lessons to the board with clear owners.

"Your vendor holds Microsoft 365 integration. Verify how, or inherit the incident."