ConnectWise Halts Cloud Services After Credential Theft Exposes 300+ Microsoft 365 Tenants

Key points

• ConnectWise disabled Cloud Backup, SaaS Security, and Cloud Management services on October 17, 2026, following the discovery of unauthorized access to application identities.
• Attackers used a compromised credential for ConnectWise Cloud Backup (formerly SkyKick) to sign in to 173 to 300+ Microsoft 365 tenants, depending on the source.
• The compromised application had broad permissions, including Directory.ReadWrite.All, allowing access to mailboxes, OneDrive, SharePoint, Teams, and directory data.
• In at least one tenant, attackers escalated privileges to Global Administrator and added credentials to other applications, including Huntress Security Platform, with validity extending until 2028.
• ConnectWise has not confirmed data exfiltration but advises customers to audit for unauthorized changes, as disabling the app does not reverse prior configuration modifications.

Background

This incident follows a series of supply chain and backup-related security issues in 2026, including a Windows 11 update that disrupted backup tools in September and a separate AOMEI Backupper compromise detailed by Google Mandiant. ConnectWise’s services are critical for managed service providers (MSPs) securing client data, making the breach significant for downstream organizations.

How outlets are covering it

The Register reported the suspension of services to probe the security issue, while The Hacker News and Cybernews emphasized the scale of the breach, citing 173 and 300+ affected tenants, respectively. Infosecurity Magazine focused on the operational impact and lack of a restoration timeline. Huntress and Microsoft highlighted the technical details, including the use of IP 144.172.64.128 and the creation of persistent backdoors. Cybernews noted a second wave targeting critical infrastructure sectors, though those attempts were unsuccessful. All sources agree that MFA does not protect against application-level credential theft, and that customers must actively audit their environments for persistence.

Why it matters

The incident underscores the risks of delegated administrative privileges in MSP environments, where a single compromised credential can expose multiple client tenants. It highlights the need for organizations to monitor application sign-ins and audit for unauthorized changes, as disabling compromised apps does not eliminate existing backdoors. The breach also raises concerns about the security of backup services, which often require broad access to function effectively.

What to watch

ConnectWise is continuing its investigation and has not provided a restoration timeline for its services. Affected organizations are advised to disable the ConnectWise Cloud Backup application, review sign-in logs for suspicious IP addresses, and audit for unauthorized credential additions or configuration changes. Microsoft and security firms recommend enabling Microsoft Graph activity logs and checking Entra audit logs for any unauthorized role assignments or consent grants.