SolarWinds hackers tried to infiltrate Mimecast

Threat actor accessed, and potentially exfiltrated, certain encrypted service account credentials created by customers hosted in the United States and the United Kingdom. These credentials establish connections from Mimecast tenants to on-premise and cloud services, which include LDAP, Azure Active Directory, Exchange Web Services, POP3 journaling, and SMTP-authenticated delivery routes. It is clear that this incident is part of a highly sophisticated large-scale attack and is focused on specific types of information and organizations.

https://www.mimecast.com/blog/important-security-update/