ConnectWise disabled seven application identities, including Cloud Backup, Teams, and SharePoint Online, following unauthorized access that compromised Microsoft 365 tenants.
Attackers utilized stolen credentials to request access tokens from Microsoft Entra ID.
The issue was detected on October 14, 2026, by the company’s internal monitoring systems. A few days later, on October 17, ConnectWise disabled seven specific application identities, including services for backup, management, and communication. At the same time, the company temporarily disabled storage and management tools, and completely stopped backups by revoking connection certificates.
How the attack worked
According to security researchers at Huntress, the attackers used stolen app credentials to request digital access keys, leveraging the permissions the apps already had. In this way, they were able to log into customer accounts.
Huntress detected suspicious connections from a specific network address in hundreds of environments, and also observed a second, targeted attempt on October 15. This second wave of attacks targeted a limited number of organizations in sensitive sectors, such as politics, national security, trade, and critical minerals.
READ ALSO
Technical issue temporarily locks down Ariana Grande and Billie Eilish websites
What about data and continuity?
ConnectWise notes that existing backups remain encrypted and isolated, however automatic downloads of new copies have stopped and access to the files is currently unavailable.
It remains unclear at this time whether the problem stemmed from a security flaw in the company's products, while the investigation into the exact way in which the perpetrators obtained the application data is ongoing.
Experts advise partners and service users to carefully monitor their environments, review application connections from October 13 onwards, and preserve activity logs.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
