China-linked hackers breach ConnectWise backup in AI-driven attack

China-aligned hackers used an AI attack tool to break into a backup service used by IT providers, giving them a route into hundreds of businesses at once, Microsoft said on Wednesday.

For cyber insurers, it is the scenario they worry most: one supplier, many victims.

In the report published yesterday, Microsoft blamed a group it calls Storm-0940 for the recent hack of ConnectWise Cloud Backup, formerly known as SkyKick. The group used ARTEX, a tool that lets AI agents run an attack from start to finish with little human input. Its developer took ARTEX closed source on 8 October after researchers linked it to attacks on South Korean banks, but copies already downloaded remain in circulation.

The speed stood out. Microsoft said the tool reached more than 2,250 tenants at 2,900 sign-in attempts a minute, “a pace that leaves defenders with little time to detect and respond”.

ConnectWise sells software to managed service providers (MSPs), the outsourced IT firms that run systems for many small businesses. Its backup tool has wide access to clients' email, files and Teams data.

According to Huntress , the attackers stole the tool's credential and on 15 October used it to log in to customer systems as the app itself, sidestepping passwords and multi-factor checks. Huntress confirmed unauthorised logins in 173 tenants as of 17 October, and says the real figure is likely higher.

In some cases, Microsoft said, the AI agents went further, changing credentials to keep access and altering admin roles. It has not said how many organisations were breached, and noted that a login does not always mean data was stolen. Targets included defence, energy, government, legal and financial services firms.

Read : Perth arrests reveal the supply chain blind spot in Australian cyber cover

ConnectWise shut the service down on 17 October and completed a full reset of all accounts and credentials in the affected environment on 19 October, according to its security advisories. Cloud Backup, SaaS Security and Cloud Management all remain suspended. The company says it is preparing a phased restoration that will take several days once it begins, and that there is no sign backup data was taken.

Why insurers should care

One stolen credential opened a door into hundreds of unrelated businesses within hours. That is exactly where “widespread event” clauses and the policy definition of “computer system” come into play, and where having a policy does not always mean being covered.

AXA XL's Vicky Sheridan flagged the trend in Insurance Business's 2026 5-Star Cyber report : “We're also seeing growing exposure to cyber risks arising from third-party technology providers.”

The outage adds another layer. With backups still offline a week on, clients cannot restore data. Cover for a supplier's outage is often sublimited, and Allianz says cyber business interruption indemnity periods typically run just 90 to 180 days.

Read : Australian firms face growing outage losses their insurance may not cover

Storm-0940 has been active since 2021. What is new is the pace. Microsoft says several hacking groups now use ARTEX, and executive vice president Igor Tsyganskiy called the ConnectWise attack “one of many” in a wave of AI-driven attacks since early October.

Costs were already climbing. The Australian Signals Directorate's Annual Cyber Threat Report 2024–25 found the average self-reported cybercrime cost for large businesses jumped 219% to $202,700 per report, though the ASD cautions that a drop in large-business reporting leaves that average exposed to outliers.

Read : AI has changed the cyber threat. Has your clients' cover kept up?

What brokers should ask

Does the client's IT provider use ConnectWise Cloud Backup or SkyKick? If so, has it checked for suspicious logins since 13 October? If data was accessed, privacy notification rules and policy conditions apply, so tell the insurer early.

Then check the wording. Does the policy cover a breach that started in a supplier's software? Is contingent business interruption included, and at what limit? Could a systemic event clause apply?

Brokers and insurers should ask the same questions of their own IT providers.

There is an irony here. ConnectWise has long itself as a path to cyber cover for MSPs, partnering in 2022 with broker Ukon (formerly FifthWall Solutions), which said it worked with more than 35 insurers. The question now is whether those policies were written for a week like this.