Update: 8 November 2026, 4:00 pm GMT. MSP Process has confirmed directly to Overe that Phishr and Triggr customers have not been impacted by this incident. These services operate on separate AWS infrastructure, separate Microsoft tenants holding application registrations, and separate management identities. The MSP Process investigation remains ongoing, and we'll continue to monitor developments.
MSP Process has confirmed a security breach. On 7 November 2026, an attacker compromised one of the company's internal servers and gained access to a storage account containing information used by its Microsoft integration services.
That storage included Microsoft Entra application client IDs and secrets, administrator refresh tokens, and details of Microsoft GDAP customer relationships. These integrations are used by MSP Process for features including Authenticator, Password Reset and Contacts Sync. MSP Process also operates Triggr and Phishr. In a direct update to Overe at 4:00 pm GMT on 8 November, a representative helping with the incident response confirmed that neither Phishr nor Triggr customers were impacted. The vendor explained that those services use separate AWS infrastructure, Microsoft tenants holding their application registrations, and management identities.
The vendor has said it cannot confirm whether each individual customer's credentials were copied. However, it has instructed affected customers to treat those credentials as compromised. Stolen app secrets could allow an attacker to access Microsoft 365 customer environments using permissions already granted to the connected application, without a normal user sign-in or MFA challenge.
If you received an incident notification email from MSP Process, you should act on it today. Follow the vendor's instructions to remove the affected app secrets, revoke relevant administrator sessions, and review your Microsoft 365 environments for suspicious changes.
If you use the affected MSP Process Microsoft integrations and are unsure whether you need to act, contact MSP Process for confirmation and current guidance. According to the vendor's 4pm clarification, Phishr and Triggr customers are not impacted by this incident. If you also use MSP Process's Authenticator, Password Reset or Contacts Sync integrations, follow any incident notification you've received for those services.
Overe was alerted to the incident on 8 November and is working directly with the vendor to understand the potential impact. We will continue monitoring the situation as it develops.
If you're concerned about your Microsoft 365 exposure, please reach out to the Overe team. We're happy to discuss your concerns and will share any important updates as more information becomes available.
Overe status | 9 November 2026: Overe has confirmed it is not directly impacted by the MSP Process security breach. This statement relates to Overe itself and does not replace the vendor's remediation guidance for customers using affected MSP Process integrations.
