1,800 MSPs impacted in Pax8 data leak after company shared partner information via email
More than a thousand MSPs have been alerted that competitors may now have access to sensitive business data
Cloud marketplace and distributor Pax8 has issued a warning about a security breach that saw data on around 1,800 customers exposed.
An email was sent to 40 of the company's UK-based managed service provider (MSP) customers with an attachment generally used for day-to-day operational reporting.
This contained Pax8 pricing and program-related information associated with 17 stock-keeping units within four Microsoft Modern Work product categories.
Almost all the customers whose data was shared were UK-based, with one located in Canada.
The email, titled "Potential Business Premium Upgrade Tactic to Save Money," was sent on January 13 and contained more than 56,000 entries in all. A follow-up email was sent immediately requesting deletion of the email, and asking recipients not to forward it.
Pax8 insists the breach did not involve any personally identifiable information (PII), authentication credentials, payment data, or any information that could enable system access.
However, the leaked data could reveal to the 40 competitors with which it was shared the MSP’s full client portfolio, what licenses they hold, and when these are due to expire, along with internal Pax8 pricing and margin information.
Threat actors are approaching affected MSPs
The data leak could help the victims' competitors poach customers by revealing which organizations use Pax8 as their distributor, the size of each customer's Microsoft environment, the timelines for contract renewal, and potentially the pricing tiers being paid.
A more sinister development has unfolded in the wake of the incident, however, with cyber criminals apparently capitalizing on the situation. According to reports from BleepingComputer, threat actors have approached some of the affected MSPs and offered to buy the data.
This information could be used by cyber criminals to craft convincing phishing attacks, for example by allowing an attacker to email a company just before their contract renewal date, pretending to be their MSP and requesting payment.
The company said it has launched an internal review to work out how the breach happened and plans to ramp up its safeguards and processes to prevent a similar incident taking place in the future.
Access instructions have now been sent to affected partners, the company revealed, allowing them to securely review information that may have been shared.
That access will be limited to the Pax8 Marketplace Primary Partner Admin and/or Partner Admin for each organization.
"Our focus continues to be on responding directly to partner questions and supporting impacted partners as they review their data and follow up with us," said the firm. "In parallel, our internal review remains ongoing as we continue to strengthen safeguards and processes."
Pax8 said partners with questions or concerns should submit a Support ticket through the Pax8 Marketplace referencing UK Partner Information Incident – Jan 13, 2026.
FOLLOW US ON SOCIAL MEDIA
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.
-
Workers are wasting half a day each week fixing AI ‘workslop’News Better staff training and understanding of the technology is needed to cut down on AI workslop
-
IBM Sovereign Core targets AI and cloud data residency gains for European enterprisesNews The new IBM Sovereign Core service allows organizations to build, manage, and deploy their own AI-ready sovereign workloads
-
The changing role of the MSP: What does this mean for security?Industry Insights Smaller businesses are more reliant on MSP support, but this also puts providers under increased scrutiny...
-
How to MFA everywhereIndustry Insights Identity online is not who you are; it is what the system accepts as proof of you, and that gap is exactly what the attackers take advantage of
-
How the channel weakened ransomware’s gripIndustry Insights What tools and techniques are empowering businesses to say no to ransomware demands?
-
NinjaOne expands availability on CrowdStrike MarketplaceNews CrowdStrike Falcon customers now have simplified access to NinjaOne’s automated endpoint management capabilities
-
Blackpoint Cyber and NinjaOne partner to bolster MSP cybersecurityNews The collaboration combines Blackpoint Cyber’s MDR expertise with NinjaOne’s automated endpoint management platform
-
LevelBlue and Akamai are teaming up to launch a managed web application and API protection serviceNews The new Managed WAAP offering aims to help organizations secure their rapidly expanding web app and API ecosystems
-
SonicWall launches new firewalls as part of Generation 8 refreshNews The vendor’s latest update includes unified management and integrated ZTNA, backed by embedded warranty and co-managed services
-
MSPs beware – these two ransomware groups are ramping up attacks and have claimed hundreds of victimsNews The Akira and Lynx ransomware groups are focusing on small businesses and MSPs using stolen or purchased admin credentials
