Ghost Service Accounts Enable M365 Data Theft in Chile
Forgotten M365 service accounts in Chile enable data theft even after employee account lockdowns.
A security analysis has revealed that compromised Microsoft 365 environments in Chile are vulnerable to data theft through forgotten or lost service accounts. These accounts, often overlooked during security audits and employee offboarding, can retain access to sensitive data even when active user accounts are secured. This oversight allows threat actors to potentially exfiltrate large amounts of data by leveraging these persistent, ghost service accounts.
AI summary of the linked source. Not reviewed by an editor. How this works
Run M365?
Get an email when a new story names M365, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe root cause of this threat is the failure to properly manage and decommission service accounts throughout their lifecycle, leaving 'ghost' accounts with persistent access to sensitive Microsoft 365 data long after they are needed. Unlike human user accounts, service accounts are frequently excluded from standard offboarding and audit processes, creating invisible attack surfaces that threat actors can exploit. This matters because a single overlooked service account can grant broad access to organizational data, bypassing all user-level security controls that have been carefully implemented. The Chile incidents demonstrate that identity hygiene is not just about active employees — every privileged identity, human or non-human, must be continuously governed.
What helps against this
How we list vendors
- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.
- Cyber asset inventory
You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.