Security update: attempted attack thwarted, your account is secure

dmitryl+itd

We want to share a brief security update with you directly.

Atera recently identified and mitigated an attempt to misuse one of our Microsoft 365 integration credentials. Our security team immediately took action and the attack was stopped. Your account, endpoints, network and any kind of data, including personal data, were not affected. All Atera services remained fully available and operating normally throughout.

The attempt was part of a large-scale campaign targeting hundreds of organizations globally across a broad range of industries. It is consistent with the foreign state-aligned actor Microsoft has publicly linked to a recent attack on other IT software vendors.

Here is what you need to know:

- We identified the activity and mitigated the attack.

- Our investigation identified only one customer out of 13,000 that may have been affected. While the chance of impact is slim, we have notified them as a precaution.

- No other customer environments were affected.

- No action is required on your part.

The activity has been mitigated, and our security team continues to monitor for related activity, as we do every day.

If you have any questions, please contact us at support@atera.com

Thank you for your continued trust in Atera.

Atera security team

mbudke

Hi Dima,

thanks a lot for sharing these notes.
I suspect you are talking about the ConnectWise incident (https://www.bleepingcomputer.com/news/security/hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack/).

For my interest:
When talking about "Microsoft 365 integration credentials" is this security incident you are talking impacting Ateras Microsoft 365 integration only OR would this (theoretically) have impacted the Entra ID synchronization which we can configure within Atera?

Thanks,
Matthias

dmitryl+itd

Hi @mbudke thanks for the question.
We’re keeping the technical details of the incident limited to the information shared in our security update, but we can confirm that your account and data were not compromised and no action is required on your side. For any account-specific questions, please reach out to our Support team.

On a side note, if you're using the Entra ID sync, you might have experienced an enforced Entra logout and request to re-enter the credentials as a part of the the action we took in the background.

mbudke

Thank you @dmitryl+itd