Ghost Service Accounts Enable M365 Data Theft in Chile

Forgotten Microsoft 365 service accounts enabled data theft in Chile despite locked employee accounts.

A Dark Reading report says ghost Microsoft 365 service accounts were used to steal data in Chile. Even when employee accounts are locked down, forgotten or lost service accounts can still compromise an organization's entire M365 environment. The available text does not name the victim, the volume of data taken, or the intrusion path beyond those orphaned service identities.

• Forgotten M365 service accounts bypassed employee account lockdowns
• The reported data theft targeted a Microsoft 365 environment in Chile
• Orphaned service identities can expose an entire tenant