Mimecast Microsoft 365 connection certificate stolen by SolarWinds actor
On January 12, 2021 Mimecast disclosed that a certificate used to authenticate its Sync and Recover, Continuity Monitor and Internal Email Protect products to Microsoft 365 Exchange Web Services had been compromised, after Microsoft alerted it. Mimecast later confirmed the incident was tied to the SolarWinds Orion compromise and the same actor; Microsoft blocked the certificate and customers re-created their connections.
- Victim
- Mimecast and its customers
- Industry
- Technology
- Country
- United Kingdom
- Intrusion began
- Not disclosed
- First disclosed
- Jan 12, 2021
- Actor
- SolarWinds Orion threat actor (Nobelium) (Nation-state)
- Initial access
- Supply chain
- Identity control that failed
- Non-human identity
- MFA
- Not applicable (no interactive login)
- Abused identity
- Non-human (service account, token, key or app)
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
A single shared certificate trusted by thousands of tenants is a high-value non-human credential; per-tenant credentials with rotation and use monitoring cap the blast radius.
Sources
- Mimecast certificate compromised by SolarWinds hackers, TechTarget SearchSecurity, Jan 12, 2021
- Hackers Steal Mimecast Certificate Used to Securely Connect with Microsoft 365, The Hacker News, Jan 13, 2021
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Shai-Hulud 2.0 npm worm exposes credentials in 25,000+ repositories 2025 · Supply chain
- Shai-Hulud self-replicating npm worm steals maintainer tokens 2025 · Supply chain
- tj-actions/changed-files GitHub Action compromise leaks CI secrets 2025 · Supply chain
- Malwarebytes email access via abused Microsoft 365 application 2021 · OAuth token abuse
Cite this record
SWI Community Team. (2026). Mimecast Microsoft 365 connection certificate stolen by SolarWinds actor. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2021-mimecast-certificate-compromise/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.