@notasnek @briankrebs Do we know if they have compromised the entire MS365 tenant ? If so OneDrive backups are probably gone as well.