Skip to content
ConnectWise Suspends Cloud Services After Credential Compromise Affecting 162 Tenants

ConnectWise Suspends Cloud Services After Credential Compromise Affecting 162 Tenants

First seen 21 Oct 2026, 11:18 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 21, 2026 at 12:16 UTC
  • •ConnectWise suspended three cloud services after a credential compromise affecting 162 tenants.
  • •Attackers accessed Microsoft 365 environments without MFA using stolen application credentials.
  • •Previously issued access tokens remain valid until expiration, posing ongoing risks.

ConnectWise suspended its Cloud Backup, SaaS Security, and Cloud Management services on October 17, 2026, after discovering unauthorized access to Microsoft 365 environments of 162 clients due to compromised application credentials. The attackers exploited a backup application credential that allowed access without multi-factor authentication (MFA) from October 15. The breach was identified by Huntress, which noted suspicious logins from external IP addresses not associated with ConnectWise's usual Azure operations. Although the compromised identities have been disabled, previously issued access tokens remain valid until they expire. This incident highlights the risk of delegated permissions in applications and the potential for privilege escalation within Azure Active Directory environments. The investigation is ongoing, and ConnectWise has not disclosed how the attackers obtained the initial credentials.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-14
Unauthorized access detected
ConnectWise discovered unauthorized access to seven application identities used for Microsoft 365 environments.
Ciberseguridadlatam
2026-10-15
Malicious logins initiated
Huntress identified suspicious logins from external IPs to 162 organizations starting on this date.
Ciberseguridadlatam
2026-10-17
Services suspended
ConnectWise disabled the compromised application identities and suspended its cloud services as a containment measure.
Ciberseguridadlatam

More articles in this cluster (2)

Following this threat?

Track ConnectWise in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (17)

1 / 4

Common questions

How many tenants are affected?
The incident affected 162 tenants of Microsoft 365 due to compromised application credentials.
What services were suspended?
ConnectWise suspended its Cloud Backup, SaaS Security, and Cloud Management services.
What should affected organizations do?
Organizations should review their Microsoft 365 environments for unauthorized changes and monitor for any suspicious activity.