Incident Score: Analysis & Impact (PAX1768401344)

In this Rankiteo incident briefing, we review the Pax8 breach identified under incident ID PAX1768401344.

The analysis begins with a detailed overview of Pax8's information like the linkedin page: https://www.linkedin.com/company/pax8, the number of followers: 58857, the industry type: Technology, Information and Internet and the number of employees: 1833 employees

After the initial compromise, the video explains how Rankiteo's incident engine converts technical details into a normalized incident score. The incident score before the incident was 776 and after the incident was 691 with a difference of -85 which is could be a good indicator of the severity and impact of the incident.

In the next step of the video, we will analyze in more details the incident and the impact it had on Pax8 and their customers.

On 13 January 2026, Pax8 disclosed Data Leak issues under the banner "Pax8 Accidental Disclosure of Internal Business and Microsoft Licensing Data".

Pax8 mistakenly sent an email to fewer than 40 UK-based partners containing a spreadsheet with internal business information, including MSP customer and Microsoft licensing data.

The disruption is felt across the environment, and exposing Internal business information, Microsoft licensing data, customer organization names, Microsoft SKUs, license counts, NCE renewal dates, partner and customer IDs, vendor and product names, gross & net bookings, currency, territory, account owner details, provision dates, cancelled book dates, postal codes, transaction types, commitment term end dates, with nearly 56,000+ entries records at risk.

In response, teams activated the incident response plan, moved swiftly to contain the threat with measures like Email recall, direct contact with recipients to request deletion, confirmation of deletion and non-forwarding, 1:1 follow-up calls, and began remediation that includes Internal review to determine cause and prevent recurrence, and stakeholders are being briefed through Follow-up email to partners acknowledging the error and requesting deletion, public notice via BleepingComputer.

The case underscores how Ongoing (internal review), with advisories going out to stakeholders covering Partners advised to delete the email and attachment, no further action required.

Finally, we try to match the incident with the MITRE ATT&CK framework to see if there is any correlation between the incident and the MITRE ATT&CK framework.

The MITRE ATT&CK framework is a knowledge base of techniques and sub-techniques that are used to describe the tactics and procedures of cyber adversaries. It is a powerful tool for understanding the threat landscape and for developing effective defense strategies.