SolarWinds Hackers Steal Parts of Mimecast Source Code

The hackers who break into various companies via SolarWinds software have also stolen source code and identification data from email security company Mimecast.

Mimecast discovered the security incident in January and has now completed the forensic investigation. Besides, it says hackers could break into its network and download the source code from some of its repositories.

Email addresses and other contact information have also been stolen and encrypted and/or hashed and salted credentials (digital identification to access services). Hashing and salting are cryptographic methods to make data not just readable in the event of a theft. It is, therefore, not certain whether hackers can also use the data.

The break-in is an offshoot of the SolwarWinds hack that became known at the end of last year. In addition, (presumably Russian) hackers succeeded in breaking into the American software company SolarWinds. By manipulating the update process there, an update to their Orion monitoring platform also placed a loophole so that hackers could easily break into Orion users, such as Mimecast.

Mimecast provides a comprehensive list of steps it has taken and what customers should do themselves.

The company says it has no evidence that content from customer emails has been viewed. But it also says that the stolen source code is basically incomplete to recreate the Mimecast service and that the process of building Mimecast executable files has not been manipulated.

However, it has reset all credentials and customers are recommended to restore their own credentials for connecting to the Mimecast platform as well. The compromised servers are being replaced and additional security monitoring and better encryption have been rolled out.