Somebody stole the master key to a backup service that IT firms install in their clients' Microsoft 365 accounts. Then they used it to sign in to at least 162 of those accounts.

Photo: Victorgrigas / Wikimedia Commons (CC BY-SA 3.0), cropped