Subject: Threat Management Center (TMC) Advisory - Incorrect Notification of Account Creation
Date of Announcement: June 7, 2021
An official email was sent from TMC informing some users that a new user had been added to their account.
This event is not a security incident. The users who received the notification were assigned to the Trend Micro Official TMC Demo Account. These users may not have been correctly transitioned from the official demo account to the individual organization accounts after their demo was completed. The new user that was added to the account was confirmed to be a Trend Micro employee that accesses this account as a regular part of their duties.
The impact of this event is limited to the notification of the email only. Within the Trend Micro demo account, there is no customer data stored nor customer information available between the various users assigned to it. The purpose of this account is to allow the download of documentation and software only. It is by security design that all users associated with a TMC account are notified when a new user is created.
No mitigations are required for the advisory. This was not a security breach but an incorrect process related to the transitioning of TMC accounts from demo to organizational accounts. To resolve this issue, individual TMC accounts that received the notification should contact the TAC to have their account transitioned to their active organizational account.
Trend Micro will be conducting an internal review of the policy and protocols surrounding the use of the Trend Micro Official Demo TMC Account. This will include the audit of accounts associated with the demo account and the correction of any abnormalities.
If you have concerns or further questions regarding this issue, contact the Trend Micro TippingPoint Technical Assistance Center (TAC).
For contact information, please click here