ConnectWise Halts Cloud Backup After Credential Theft Breaches Microsoft 365 Tenants

Key points

• ConnectWise disabled seven application identities, including Cloud Backup and Cloud Management, on October 17, 2026, at 07:00 UTC.
• Attackers used compromised credentials to authenticate as the application, bypassing user-level multi-factor authentication (MFA).
• Huntress identified malicious activity from IP address 144.172.64[.]128, with successful sign-ins in approximately 300 out of 1,000 monitored tenants.
• ConnectWise states existing backup archives remain encrypted and unbreached, but scheduled backups are currently halted.
• The incident was detected on October 14, 2026, through cybersecurity monitoring, with malicious sign-ins observed until October 15.

Background

This incident follows earlier coverage on October 17, 2026, which reported that threat actors exploited a compromised ConnectWise Cloud Backup credential to access 173 Microsoft 365 tenants. The breach allows attackers to read mail, files, and directory data, with some tenants showing unauthorized privilege escalation. ConnectWise has suspended the application pending investigation. This event is distinct from recent changes to Microsoft 365 Family and Premium plans, which reduced OneDrive storage to a shared 2TB pool effective after May 2, 2027.

How outlets are covering it

ConnectWise emphasizes that existing backup archives remain encrypted and unbreached, focusing on the suspension of application identities to prevent new authentication. Huntress highlights the risk of persistence through added credentials in Microsoft tenants, noting that disabling the service does not remove planted secrets. Rescana frames the incident as a credential theft rather than a software vulnerability, stressing the need for least-privilege access controls. Todyl researchers found no evidence of persistence in nine analyzed tenants, contrasting with Huntress’s findings of privilege escalation in others. Microsoft confirmed malicious activity but did not specify the extent of data exfiltration.

Why it matters

This incident underscores the critical risks of delegated admin privileges in MSP environments, where a single compromised credential can grant attackers broad access to multiple customer tenants. It highlights the limitations of user-level MFA against application-based attacks and the need for robust monitoring of service principal activity. The breach also raises concerns about the security of cloud backup services, which are essential for data recovery in managed IT environments.

What to watch

ConnectWise is conducting an ongoing investigation to determine the exact credential-exposure mechanism. Partners are advised to review sign-ins from October 13, 2026, onward, specifically for activity from IP address 144.172.64[.]128. Administrators should disable affected applications and review application credentials for unauthorized additions. ConnectWise has not provided a timeline for restoring the Cloud Backup service, but existing archives are expected to be accessible once services are restored.