UNITED STATES
SECURITIES AND EXCHANGE COMMISSION
WASHINGTON, D.C. 20549
FORM
CURRENT REPORT
Pursuant to Section 13 or 15(d)
of the Securities Exchange Act of 1934
Date of Report (Date of earliest event reported):
(Exact name of Registrant as Specified in Its Charter)
| Bailiwick of |
||||
| (State or other jurisdiction of incorporation or organization) |
(Commission File Number) |
(I.R.S. Employer Identification No.) |
| |
||||
| (Address of principal executive offices) | (Zip Code) |
Registrant’s Telephone Number, Including Area Code:
Not Applicable
(Former Name or Former Address, if Changed Since Last Report)
Check the appropriate box below if the Form 8-K filing is intended to simultaneously satisfy the filing obligation of the registrant under any of the following provisions (see General Instructions A.2. below):
| Written communications pursuant to Rule 425 under the Securities Act (17 CFR 230.425) |
| Soliciting material pursuant to Rule 14a-12 under the Exchange Act (17 CFR 240.14a-12) |
| Pre-commencement communications pursuant to Rule 14d-2(b) under the Exchange Act (17 CFR 240.14d-2(b)) |
| Pre-commencement communications pursuant to Rule 13e-4(c) under the Exchange Act (17 CFR 240.13e-4(c)) |
Securities registered pursuant to Section 12(b) of the Act:
| (Title of each class) |
(Trading Symbol) |
(Name of each exchange on which registered) | ||
Indicate by check mark whether the registrant is an emerging growth company as defined in Rule 405 of the Securities Act of 1933 (§ 230.405 of this chapter) or Rule 12b-2 of the Securities Exchange Act of 1934 (§ 240.12b-2 of this chapter).
Emerging growth company
If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐
| Item 8.01 | Other Events. |
On January 26, 2021, Mimecast Limited, a corporation organized under the laws of the Bailiwick of Jersey, Channel Islands (the “Company”), posted a public statement on the Mimecast Blog on its website (www.mimecast.com/blog). The public statement is being furnished as Exhibit 99.1 to this Report on Form 8-K.
The Company currently intends that any further announcements regarding the information included in the public statement will be disclosed on the Mimecast Blog on the Company’s website (www.mimecast.com/blog).
The information in this Report on Form 8-K and Exhibit 99.1 attached hereto are intended to be furnished and shall not be deemed “filed” for purposes of Section 18 of the Securities Exchange Act of 1934, as amended (the “Exchange Act”) or otherwise subject to the liabilities of that section, nor shall they be deemed incorporated by reference in any filing under the Securities Act of 1933, as amended, or the Exchange Act, except as expressly set forth by specific reference in such filing.
| Item 9.01 | Financial Statements and Exhibits |
(d) Exhibits.
| Exhibit Number |
Description | |
| 99.1* | Public Statement from Mimecast Limited dated January 26, 2021 | |
| 104 | Cover Page Interactive Data File (embedded within the Inline XBRL document) | |
| * | Furnished herewith. |
1
SIGNATURES
Pursuant to the requirements of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned thereunto duly authorized.
| Mimecast Limited | ||||||
| Date: January 26, 2021 | By: | /s/ Robert P. Nault | ||||
| Robert P. Nault | ||||||
| Senior Vice President and General Counsel | ||||||
2
Exhibit 99.1
PUBLIC STATEMENT
Important Security Update
At Mimecast, we prioritize the security of our customers, and our commitment to being transparent with them, above all else. These two principles have guided our rapid response to the recent security incident, as well as this update and the customer and partner guidance we are providing today via directed actions in the Administration Console and the Mimecast Community.
As we previously shared, when Microsoft informed us about the compromise of a Mimecast-issued certificate used to authenticate a subset of Mimecast’s products, we advised affected customers to break and re-establish their connections with newly issued keys. The vast majority of these customers have taken this action, and Microsoft has now disabled use of the former connection keys for all affected Mimecast customers.
We also launched an internal investigation, supported by leading third-party forensics experts, and we are coordinating our activities with law enforcement. Our investigation has now confirmed that this incident is related to the SolarWinds Orion software compromise and was perpetrated by the same sophisticated threat actor.
Our investigation also showed that the threat actor accessed, and potentially exfiltrated, certain encrypted service account credentials created by customers hosted in the United States and the United Kingdom. These credentials establish connections from Mimecast tenants to on-premise and cloud services, which include LDAP, Azure Active Directory, Exchange Web Services, POP3 journaling, and SMTP-authenticated delivery routes.
Although we are not aware that any of the encrypted credentials have been decrypted or misused, we are advising customers hosted in the United States and United Kingdom to take precautionary steps to reset their credentials.
We have taken actions to isolate and remediate the identified threat, which we believe to be effective. We continue to examine and closely monitor our environment. We will continue to communicate updates directly to our customers if warranted, and, where appropriate, these will be disclosed here on the Mimecast Blog. While we are committed to transparency and sharing insights with our customers, there may be limits to the details we can provide at this time while elements of the investigation into this threat actor remain ongoing.
Recent threat intelligence reports have described the campaign of attacks waged by this threat actor. It is clear that this incident is part of a highly sophisticated large-scale attack and is focused on specific types of information and organizations.
Now more than ever, transparency and cooperation within the security community are essential to an effective response. We expect that additional organizations will learn or share that they were affected by the threat actor behind the SolarWinds Orion software compromise. We have benefited from the expertise shared by others facing this threat, and we are committed to doing the same, based on our own experience, to create a more secure and resilient community.
Protecting our customers will always be our company’s top priority.
Forward-Looking Statements
This communication contains “forward-looking” statements, which are subject to the safe harbor provisions of the Private Securities Litigation Reform Act of 1995 and other federal securities laws, that are based on currently available information and our current beliefs, expectations and understanding. These forward-looking statements include statements regarding Mimecast’s current understanding of the identity and likely targets of the sophisticated threat actor, the scope and impact of the attack, the potential decryption and/or misuse of the encrypted credentials, the number and location of impacted customers, the effectiveness of any current or future isolation and remediation efforts, the likelihood that other companies will be affected by the threat actor, and the information provided to us by third parties during the course of our ongoing investigation. Mimecast intends that all such forward-looking statements to be covered by the safe harbor provisions for forward-looking statements contained in Section 21E of the Securities Exchange Act of 1934, as amended, and the Private Securities Litigation Reform Act of 1995. These statements are subject to future events, risks and uncertainties – many of which are beyond our control or are currently unknown to Mimecast. These risks and uncertainties include, but are not limited to, risks and uncertainties related to the uncovering of new information in the course of our investigation related to the nature, cause and scope of the issue, the reputational, financial, legal and other risks related to potential adverse impacts to our customers and partners, and the other risks, uncertainties and factors detailed in Mimecast’s filings with the Securities and Exchange Commission. Mimecast is providing the information in this communication as of this date and assumes no obligations to update the information included in this communication or revise any forward-looking statements, whether as a result of new information, future events or otherwise.
January 26, 2021
Document and Entity Information |
Jan. 26, 2021 |
|---|---|
| Cover [Abstract] | |
| Entity Registrant Name | Mimecast Ltd |
| Entity Tax Identification Number | 00-0000000 |
| Amendment Flag | false |
| Entity Central Index Key | 0001644675 |
| Document Type | 8-K |
| Document Period End Date | Jan. 26, 2021 |
| Entity Incorporation State Country Code | Y9 |
| Entity File Number | 001-37637 |
| Entity Address, Address Line One | 1 Finsbury Avenue |
| Entity Address, City or Town | London |
| Entity Address, Country | GB |
| Entity Address, Postal Zip Code | EC2M 2PF |
| City Area Code | (781) |
| Local Phone Number | 996-5340 |
| Written Communications | false |
| Soliciting Material | false |
| Pre Commencement Tender Offer | false |
| Pre Commencement Issuer Tender Offer | false |
| Security 12b Title | Ordinary Shares, nominal value $0.012 per share |
| Trading Symbol | MIME |
| Security Exchange Name | NASDAQ |
| Entity Emerging Growth Company | false |