Commvault Metallic breach exposes Microsoft 365 app secrets
Commvault said Microsoft notified it on February 20, 2025 of unauthorized activity by a suspected nation-state actor in Commvault's Azure environment, where the actor had exploited a zero-day later tracked as CVE-2025-3928. On May 22, 2025 CISA said the actor may have accessed client secrets for Commvault's Metallic Microsoft 365 backup SaaS, giving potential access to customers' Microsoft 365 environments, and that the activity may be part of a broader campaign against SaaS applications with default configurations and elevated permissions.
- Victim
- Commvault and a small number of its Metallic Microsoft 365 backup customers
- Industry
- Technology
- Country
- United States
- Intrusion began
- Not disclosed
- First disclosed
- Mar 7, 2025
- Actor
- Unnamed nation-state actor (per Commvault) (Nation-state)
- Initial access
- Third-party access
- Identity control that failed
- Non-human identity
- MFA
- Not applicable (no interactive login)
- Abused identity
- Non-human (service account, token, key or app)
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
A vendor held standing app secrets with broad permissions into customer tenants. Customers who could rotate those secrets, restrict the service principals by location and audit their sign-ins were the ones able to contain it.
Sources
- Notice: Security Advisory, Commvault, Mar 7, 2025
- Advisory Update on Cyber Threat Activity Targeting Commvault's SaaS Cloud Application (Metallic), CISA, May 22, 2025
- Commvault clients should beware of campaign targeting cloud applications, CISA says, The Record, May 23, 2025
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Stolen ConnectWise app credentials open Microsoft 365 tenants across MSP customers 2026 · Third-party access
- US Treasury workstations accessed through a stolen BeyondTrust Remote Support key 2024 · Third-party access
- Cisco Duo SMS MFA logs stolen from a phished telephony provider 2024 · Third-party access
- Signal account re-registration via Twilio support console 2022 · Third-party access
Cite this record
SWI Community Team. (2026). Commvault Metallic breach exposes Microsoft 365 app secrets. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2025-commvault-metallic-azure-app-secrets/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.