2025 Commvault — Metallic/SaaS incident; CISA advisory on suspected nation-state activity and CVE-2025-3928
Data compromised
Application secrets and M365 integration credentials referenced in CISA remediation guidance
Technical writeup
CISA and Commvault published alerts after suspected nation-state targeting of Metallic SaaS; coverage summarized zero-day exploitation and cloud identity/credential rotation guidance.
Root cause
Suspected zero-day exploitation and follow-on cloud control-plane abuse (per CISA/Commvault advisories)