Summary: Commvault has confirmed that a nation-state threat actor breached its Azure environment but did not gain access to customer backup data. The company is actively working with cybersecurity firms and authorities to investigate the incident, which affected only a small number of customers. Customers are advised to implement security measures to prevent future attacks, including monitoring sign-in activities and applying a Conditional Access policy.
Affected: Commvault, Microsoft Azure
Keypoints :
- Commvault detected suspicious activity in its Azure environment, notified by Microsoft on February 20, 2025.
- No unauthorized access to customer backup data and no material impact on business operations was reported.
- CISA has added the exploited zero-day vulnerability (CVE-2025-3928) to its Known Exploited Vulnerabilities Catalog.
- Recommendations for customers include applying Conditional Access policies and monitoring sign-in activities regularly.