Pax8 Accidentally Exposes MSP Customer and Microsoft Licensing Data in Email Mishap Cloud marketplace and distributor Pax8 has confirmed an accidental data exposure after an internal email containing a spreadsheet with sensitive business information including MSP customer and Microsoft licensing data was mistakenly sent to fewer than 40 UK-based partners on January 13, 2026. The email, titled "Potential Business Premium Upgrade Tactic to Save Money," was sent by an EMEA-based strategic account manager and included a CSV attachment with internal pricing and Microsoft program details affecting approximately 1,800 partners, primarily in the UK, with one in Canada. Recipients reported that the file contained customer organization names, Microsoft SKUs, license counts, and New Commerce Experience (NCE) renewal dates, along with over 56,000 entries detailing fields such as: - Partner and customer names/IDs - Vendor and product names - Gross and net bookings - License quantities and commitment terms - Postal codes and account ownership details Pax8 immediately attempted to recall the email and followed up with recipients, requesting deletion of the message and attachment. The company stated that the file did not contain personally identifiable information (PII) but included confidential business data, such as pricing structures and Microsoft program management details information typically restricted to the MSP and Pax8. In a follow-up notice, Pax8 confirmed it had contacted all recipients directly, required confirmation of deletion, and launched an internal review to prevent future incidents. The company emphasized that the exposure posed no impact to marketplace security or availability. However, threat actors have reportedly begun targeting affected MSPs, attempting to purchase copies of the exposed dataset. The leaked information could be valuable to competitors revealing customer portfolios, contract renewal timelines, and pricing tiers or to cybercriminals, who could use it to craft targeted phishing campaigns, business email compromise (BEC) attacks, or extortion attempts tied to license renewals. Pax8, a fast-growing cloud commerce platform with 1,700+ employees, 47,000+ partners, and $2 billion in annual revenue, operates in 18 countries and has seen significant expansion in Europe. The company later confirmed the incident to BleepingComputer, aligning with its public statements.