Deloitte Email Hack (2017)

In September 2017, Deloitte disclosed that it had been the victim of a sophisticated cyberattack targeting its global email server. The attackers gained access to the Microsoft Azure-based email platform used by Deloitte's global workforce. The compromised data included emails and attachments from approximately 350,000 customers, containing highly sensitive information about client strategies, legal matters, and confidential business negotiations. The breach was discovered in March 2017 but was not publicly disclosed until September. Deloitte stated that only a small number of accounts were compromised but acknowledged that the attackers had 'deep' access to the system. The breach was particularly damaging because of Deloitte's role as an auditor and consultant to the world's largest corporations and governments.

Deloitte is one of the Big Four accounting firms, providing audit, tax, consulting, and financial advisory services to a vast global client base including many Fortune 500 companies and government agencies. The firm's access to highly sensitive client data made it a prime target for espionage.

The attackers gained access using a compromised administrator account on Deloitte's Azure Active Directory. The single compromised credential allowed access to the entire global email system. The breach was discovered after anomalous login activity was detected.

Vulnerabilities exploited

• Weak or compromised administrator credentials

MITRE ATT&CK techniques

• T1078

The perpetrator of the Deloitte hack has never been publicly identified. The sophistication of the attack suggested a well-resourced actor, possibly state-sponsored.

Attribution sources

• Deloitte Confirmation
• The Guardian
• Media Reports

Additional victims

• Deloitte Clients (including major corporations and governments)

Countries affected

• Global

Data types

• Internal Emails
• Client Communications
• Strategic Documents
• Legal Correspondence
• Confidential Business Data

Notable documents

• Deloitte internal emails (accessed by attackers)

Reputational damage, client trust erosion, potential legal liability.

Public reaction

The breach caused significant concern among Deloitte's clients and raised questions about the security of Big Four accounting firms.

Political impact

Governments and regulators reviewed their relationships with Deloitte and other consulting firms.

Geopolitical consequences

The breach highlighted the espionage risk posed by compromised credentials at firms with access to sensitive global economic and government data.

Deloitte faced investigations by UK and US regulators.

Civil lawsuits

• Potential client lawsuits for breach of confidentiality

Policy changes

• Increased scrutiny of professional services firms' cybersecurity.

Security improvements

• Deloitte implemented multi-factor authentication globally.
• Enhanced monitoring of administrator accounts.

Significance

The Deloitte hack demonstrated that the world's largest professional services firms were vulnerable to credential-based attacks and highlighted the downstream risk to their clients.

Legacy

The incident led to the widespread adoption of multi-factor authentication across the professional services industry.

Media partners

• The Guardian

Publishing organisations

• Deloitte

Deloitte secured its email platform, implemented MFA, and notified affected clients.

Official documents

• Deloitte statement (Sept 2017)

References

1. [1]The Guardian reporting (2017)
2. [2]Deloitte corporate statement