M365 Group was Spoofed - MSFT has no idea how this happened.