Mimecast: Attention Mimecast Accounts

Please view Mimecast's latest blog publication regarding Microsoft & Mimecast-issued certificate

IMPORTANT UPDATE FROM MIMECAST 

Microsoft recently informed us that a Mimecast-issued certificate provided to certain customers to authenticate Mimecast Sync and Recover, Continuity Monitor, and IEP products to Microsoft 365 Exchange Web Services has been compromised by a sophisticated threat actor.

Approximately 10 percent of our customers use this connection. Of those that do, there are indications that a low single digit number of our customers’ M365 tenants were targeted.

Mimecast has already contacted these customers to remediate the issue.

Customers who use this certificate-based connection to authenticate Mimecast Sync and Recover, Continuity Monitor, and IEP products are being asked to take the precautionary action of immediately deleting the existing certificate-based connection within their M365 tenant and re-establishing a new certificate-based connection with Mimecast. See instructions here. Taking this action will not impact inbound or outbound mail flow or associated security scanning.

Customers who do not use this certificate-based connection do not need to take any action.

How have notifications been sent and what are recommended next steps?

• For MSP partners and customers who should take precautionary action: Customers who have Administrative Console access have received a notification in Adcon. MSP partners have also received notifications in the Administrative Console and partner portal, as well as via email. These partners should follow the instructions provided to delete the existing certificate-based connection within their customer’s M365 tenant and re-establish a new certificate-based connection with Mimecast.
  
  
• For MSP partners and customers who do not need to take precautionary action: Customers who have Administrative Console access have received a courtesy notification in Adcon. MSP partners have also received a courtesy notification in the Administrative Console and partner portal. No action is required for these partners.

For more information, please read the FAQ and/or contact your Mimecast partner account manager. We have also posted a statement on the Mimecast blog and information on Mimecaster Central.

Thank you for your support as we work to best protect our customers; and thank you, as always, for being a valued member of the Mimecast Community.