Threat watch / Breach
MSP Process: app credentials and tokens for Microsoft partner tenants taken from the MSP software vendor
MSP Process, a software vendor for managed service providers, says an unauthorized party reached one of its internal servers and part of its infrastructure on November 7, 2026, between 09:56 and about 14:40 UTC. That infrastructure held app credentials and access tokens for partners who use its features connected to Microsoft Partner Center admin relationships (Authenticator, Password Reset, Contacts sync). The vendor rotated its credentials and disabled its identity features for all partners. Huntress, as reported by The Stack, saw successful malicious token grants in 47 tenants. MSP Process has not said how the attacker got in.
- Sector
- Tech & SaaS
- Way in
- Not public yet
- Product or vendor
- MSP Process, Microsoft Partner Center, Microsoft Entra ID
- tenants with successful malicious token grants, according to Huntress[2]
- 47
- How it happened
- MSP Process says an unauthorized party gained access to one of its internal servers and part of its infrastructure, and that a stolen access key stopped working at 19:05 UTC on November 7. It does not say how the attacker first got in. Huntress logs reported by The Stack show password spraying against MSP Process staff accounts on November 6 with no success seen, then the first successful token on November 7 at 10:01 UTC. MSP Process warned that whoever holds one of its apps' client secrets can use those permissions directly in client tenants, with no user sign-in or MFA.[1][2] Checked 11 Nov 2026
- What was stolen
- MSP Process says the infrastructure held processing data for its Partner Center features, including app credentials and access tokens for the partners who use them. The Stack and Field Effect report that this covered Entra app client IDs and secrets, admin refresh tokens and GDAP relationship lists; MSP Process has not confirmed that detail. In one tenant, Huntress says the attacker exfiltrated data.[1][2][3] Checked 11 Nov 2026
- Who was impacted
- Managed service providers using MSP Process and their client tenants. Partners affected were contacted on November 7 and all others on November 8. The Stack says the vendor serves over 1,000 MSPs. Huntress counted 47 tenants with successful malicious token grants and significant hands-on activity in one, where the attacker added roles, planted secrets across dozens of apps, created service accounts and re-enabled accounts.[1][2][3] Checked 11 Nov 2026
- Threat actor
- Not attributed. No named actor. Field Effect says the activity has not been publicly attributed.
Timeline
- Huntress sees password spraying against MSP Process staff accounts from residential proxies, with no successes seen, and failed client-secret sign-ins, according to The Stack. [2]
- Between 09:56 and about 14:40 UTC, an unauthorized party has access to an MSP Process internal server and part of its infrastructure. The stolen access key stops working at 19:05 UTC. Affected partners are contacted the same day. [1]
- MSP Process contacts all other partners and asks them, as a precaution, to rotate API keys stored in MSP Process. Its Authenticator verification and identity management features stay disabled for all partners. [1]
- The Stack reports Huntress' findings: 47 tenants with successful malicious token grants. The MSP Process CEO tells customers the breach is contained, that Sophos leads the incident response, and that containment on the platform does not on its own confirm partner tenants are clean. [2]
- Field Effect advises reviewing Entra ID audit logs from about November 6, and notes that Free-tier records tied to the incident begin to expire on November 14. [3]