ConnectWise Cloud Backup Breach Exposes 173 Microsoft 365 Tenants to Data Theft
Threat actors exploited a compromised credential for ConnectWise Cloud Backup to access 173 Microsoft 365 tenants. The breach allows attackers to read mail, files, and directory data, with some tenants showing unauthorized privilege escalation. ConnectWise has suspended the application pending investigation.
Key points
- Huntress confirmed unauthorized sign-ins in 173 partner and customer tenants using a compromised ConnectWise Cloud Backup credential.
- The attacker used IP address 144.172.64.128 to obtain Microsoft Graph tokens on October 15, 2026, between 06:13 and 08:34 UTC.
- The compromised application retains broad permissions to access mailboxes, OneDrive, SharePoint, Teams, and directory data across all consented tenants.
- In at least one tenant, the attacker added itself to the Global Administrator role and injected new credentials into trusted MSP and security applications.
- ConnectWise has closed access to the Cloud Backup application and advises users to disable the app and audit logs for suspicious activity.
Background
This incident follows a broader trend of supply chain compromises affecting backup and security software. In September 2026, Microsoft dismantled the EvilTokens phishing service, which abused OAuth authentication to compromise thousands of accounts. Additionally, recent reports from Google and ManageEngine detailed an ephemeral supply chain attack on AOMEI Backupper, where attackers briefly tampered with update servers to deliver malware. These events highlight the increasing risk posed by third-party applications with extensive permissions in enterprise environments.
Why it matters
The breach demonstrates how a single compromised vendor credential can cascade into widespread data exposure across multiple organizations. Because the application holds broad permissions, attackers can access sensitive client data without triggering standard user sign-in alerts. The incident underscores the critical need for organizations to monitor service principal sign-ins and promptly revoke access to third-party applications when compromises are detected.
What to watch
ConnectWise is investigating the breach and working to reset credentials. Organizations are advised to disable the ConnectWise Cloud Backup application, enable Microsoft Graph activity logs, and audit Entra logs for unauthorized role assignments or credential changes since October 13, 2026. Microsoft is also tracking the attack and recommending security teams review service principal sign-ins from unrecognized IP addresses.
Want the full story? Read the original reporting
Read on The Hacker News