ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants

ConnectWise, an IT management software provider, suspended its Cloud Backup service on October 17, 2026, after attackers compromised Microsoft 365 tenants. The breach occurred on October 14, when unknown threat actors gained unauthorized access to application identities and compromised the software. ConnectWise disabled seven ConnectWise application identities and revoked certificates used for affected application connections across all users.

The incident did not reverse changes made inside a tenant, but the affected shared Cloud Backup credentials became invalid. Scheduled backups were not running, and access to backup archives and restoration capabilities remained unavailable. ConnectWise emphasized that existing archives remained encrypted, isolated, and preserved, with no evidence of breach or unauthorized access.

The company temporarily took its SaaS Security and Cloud Management offline for review. The attack's danger lies in its ability to enable attackers to abuse application credentials to access customers' Microsoft 365 environments without stealing individual passwords. This could allow attackers to access various Microsoft services, including mailboxes, SharePoint documents, Teams messages, and directory information.

Huntress, a managed security service provider, identified a second wave of targeted attempts from an IP address on October 15, hitting 16 tenants, of which 300 succeeded. Partners were advised to implement Entra controls, restrict client secrets, and limit those holding Application Administrator and Cloud Application Administrator roles.