TeamViewer corporate IT intrusion via a compromised employee account
TeamViewer detected an irregularity in its internal corporate IT environment on June 26, 2024, disclosed it the next day, and attributed it to APT29 (Midnight Blizzard). The attacker used credentials of a standard employee account to copy employee directory data, including encrypted employee passwords. TeamViewer said the product environment, connectivity platform and customer data were not affected, and closed the investigation on July 4.
- Victim
- TeamViewer
- Industry
- Technology
- Country
- Germany
- Intrusion began
- Jun 26, 2024
- First disclosed
- Jun 27, 2024
- Actor
- APT29 (Midnight Blizzard) (Nation-state)
- Initial access
- Stolen credentials
- Identity control that failed
- Authentication
- MFA
- Not disclosed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
A standard employee login reached the corporate directory. Phishing-resistant MFA and segmentation between corporate IT and the product environment, which TeamViewer credits with containment, are the controls that mattered.
Sources
- Security bulletin TV-2024-1005: statement on corporate IT environment, TeamViewer, Jun 27, 2024
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- LAPSUS$ source code theft from Microsoft via a single compromised account 2022 · Stolen credentials
- GhostAction returns: hijacked GitHub accounts push secret-stealing workflows 2026 · Stolen credentials
- PowerSchool SIS data theft through a compromised support-portal credential 2025 · Stolen credentials
- AT&T call and text records stolen from its Snowflake workspace 2024 · Stolen credentials
Cite this record
SWI Community Team. (2026). TeamViewer corporate IT intrusion via a compromised employee account. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2024-teamviewer-apt29-employee-account/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.