ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants

Key Points:

• ConnectWise disabled seven application identities and suspended its Cloud Backup service on October 17, 2026, after unauthorized access was detected, affecting Microsoft 365 tenants and preventing new authentications through those connections.
• The company confirmed that existing backup archives remain encrypted and isolated with no evidence of breach, but scheduled backups and restoration capabilities are currently unavailable, and SaaS Security and Cloud Management services were temporarily taken offline for review.
• The attackers exploited stolen application credentials to access multiple Microsoft 365 services without needing individual user passwords, potentially granting them extensive permissions including Global Administrator roles and persistence through added client secrets.
• Huntress security analysts observed a targeted second wave of manual attack attempts on October 15, focusing on 16 tenants in sensitive sectors, with nearly 1,000 Microsoft Entra tenants showing sign-in activity from the attacker’s IP, 300 of which succeeded in unauthorized sign-ins.
• Partners are urged to review their Microsoft 365 environments for suspicious activity, disable affected applications, audit sign-ins and permissions, and implement Microsoft Entra security controls to limit damage from stolen application credentials.