ConnectWise has disabled seven application identities and suspended its Cloud Backup service after unknown attackers gained unauthorized access to the credentials and compromised Microsoft 365 tenants. The company took action on October 17, 2026, by revoking certificates used for affected application connections across all users. ConnectWise noted that while scheduled backups are not running and restoration capabilities are unavailable, existing backup archives remain encrypted and preserved with no evidence of breach or unauthorized access.
The company identified the security incident on October 14 through its monitoring systems. Attackers used the stolen application credentials to authenticate as ConnectWise applications and potentially access customer Microsoft 365 environments, including mailboxes, SharePoint documents, Teams messages, and directory information. Security researchers at Huntress confirmed malicious activity through October 15 and identified a second wave of targeted attempts against 16 tenants in policy, national security, trade, and critical mineral sectors, though these efforts were unsuccessful.
Source: Read the full story at The Hacker News
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
