Short answer
Todyl, a security vendor, reports that since 1 November 2026 one operator has used still-valid stolen Entra application secrets to sign in as MSP workloads, then searched tenants and bulk-downloaded files. It calls the activity ongoing and has not attributed it. Only vendor reporting was available when this was written.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Managed service providers and their clients (reported by Todyl) |
|---|---|
| Incident type | Account takeover |
| Status | Under investigation |
| Sector | Managed IT services |
| Country | Global |
| Detected | 2026-11-01 |
| Disclosed | 2026-11-04 |
| People or records affected | Roughly 18 organizations targeted and 27 reached, including MSP clients, per Todyl; the counts cover only organizations that send logs to Todyl |
What data was exposed
- 81 files downloaded from SharePoint and about 2,279 mailbox items accessed, per Todyl
- Possible exposure of secrets stored in Key Vault and in credential or configuration documents
- Azure DevOps sessions replayed in some cases
What happened
Todyl published an incident report saying that from 1 November 2026 one operator has signed in to the Microsoft 365 and Azure environments of managed service providers (MSPs) as their own applications. The operator used stolen client secrets that were still valid. Todyl says this is not a Microsoft vulnerability, that it has not tied the activity to a known actor and that the campaign was still ongoing when it wrote.
This post rests on Todyl’s findings, with The Hacker News summarizing them in its 5 November ThreatsDay roundup. We have not found an independent confirmation or a statement from any named victim.
What Todyl reports
According to Todyl, about 45 application registrations at roughly 18 organizations were targeted, more than 33 authenticated successfully, and the operator reached 27 organizations, including MSP clients. After signing in, it requested Azure Resource Manager and Key Vault tokens, ran wildcard Microsoft Graph searches and downloaded SharePoint files at roughly one per second, focusing on credential and configuration files. Todyl counts 81 files and about 2,279 mailbox items. Azure DevOps access was also abused through a federated workload identity and replayed user sessions.
Timeline
Todyl’s timeline shows first access on 1 November at 08:45 UTC, bulk downloads starting on 2 November and a sweep of 15 client tenants on 3 November. Once detections fired, the operator switched to spoofed browser signatures and tried to replay refresh tokens, which Todyl says Conditional Access blocked.
What to do
Todyl’s advice for MSPs is to block the operator IP it names, hunt service principal sign-in logs, remove suspicious secrets, revoke sessions and tokens, rotate secrets in Key Vaults the apps could read, and audit Partner Center and delegated admin relationships. Long term it recommends managed identities and workload federation in place of client secrets.
If your IT provider contacts you about this, confirm by a number you already trust. Attackers who read mailboxes can send convincing follow-up requests. See our guide to fake invoice and business email scams, our phishing messages guide and the data breach checklist. A related supply-chain case is the ConnectWise cloud backup attack.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phishing or fraud aimed at MSP clients using information taken from their mailboxes and files.
- Fake security alerts from an MSP or Microsoft that ask for credentials or consent to a new app.
- Extortion or resale of documents containing credentials and configuration details.
What to do if you are affected
- 01MSPs: review service principal and non-interactive sign-in logs for the IP address 199.19.77.84, the one Todyl identifies as the operator.
- 02Remove suspicious secrets and federated credentials and revoke user sessions, personal access tokens and SSH keys if you find signs of misuse.
- 03Rotate secrets held in any Key Vault the affected apps could read, and credentials found in accessed documents.
- 04Review Partner Center and delegated admin (GDAP) relationships, and notify customers where your agreements require it.
- 05Move from client secrets to managed identities or workload federation where possible.
Frequently asked questions
Is this a Microsoft vulnerability?
Todyl says no Microsoft vulnerability is involved. The operator signs in with stolen client secrets that were still valid.
Who is behind it?
Todyl has not attributed the activity to a known actor. It assesses it as unrelated to the October 2026 ConnectWise Cloud Backup compromise.
How reliable are the numbers?
Todyl calls its counts a floor, since they cover only organizations that send logs to Todyl. The Hacker News summarizes Todyl's report rather than confirming it independently, so treat the figures as a vendor's findings.
Was persistence established?
Todyl says it had not observed new consents, credentials, roles or users as of its update. It adds that Conditional Access blocked the actor's refresh-token replays.
Sources
- Stolen app credentials, real access: an actor is signing into Entra ID and Azure DevOps as your workloads, Todyl, 2026-11-04
- ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks, The Hacker News, 2026-11-05
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.