ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants

Live updates

1. 2h ago

   ConnectWise Suspends Cloud Backup Following Microsoft 365 Breach

   ConnectWise has disabled seven application identities and suspended its Cloud Backup service after unknown threat actors gained unauthorized access, compromising Microsoft 365 tenants via a credential compromise involving SkyKick credentials. The IT management software provider took action on October 17, 2026, revoking certificates across all users. Managed service providers are currently scrambling to determine tenant impact as services remain unavailable while the company continues remediation, security validation, and phased restoration expected to return in stages over several days.

   Why it matters

   The supply-chain attack demonstrates how a trusted multi-tenant backup application can serve as a cross-tenant access path for unauthorized actors. The incident leaves vendors, managed service providers, and tenant owners facing complex logging, containment, and recovery duties. While ConnectWise disabled affected connections to prevent new authentication, the action does not reverse changes previously made inside compromised tenants.

   What is confirmed

   • ConnectWise disabled seven application identities on October 17, 2026, at 07:00 UTC during its investigation.
   • The company suspended the Cloud Backup service by revoking certificates used for affected application connections across all users.
   • ConnectWise stated that disabling the affected connections prevents new authentication but does not reverse prior changes inside a tenant.
   • Service availability for ConnectWise Cloud Backup, SaaS Security, and Cloud Management is planned to return in stages over several days.

   Still unconfirmed

   • China-linked hackers used an AI framework called ARTEX to target more than 2,250 Microsoft 365 tenants following the ConnectWise breach.
   • The security incident specifically resulted in 173 Microsoft 365 tenants being compromised through credential abuse.

   What to watch next

   • Restoration and return to service for impacted ConnectWise cloud services by the end of the week as targeted by CTO David Raissipour.
   • Further disclosures from Microsoft and cybersecurity analysts regarding the scale of tenant compromise and threat actor attribution.
   Sources used for this update (17)

   1. www.yahoo.com — Yahoo
   2. help.naver.com — Futures Flat As Oil Rebounds After Trump's "Energy Ceasefire" Unravels, Memory Stocks Slide | ZeroHedge
   3. BleepingComputer — Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
   4. Rescana — ConnectWise Credential Compromise Enables Unauthorized Access to 173 Microsoft 365 Tenants: Cybersecurity Incident Analysis
   5. GBHackers News — Hackers Use ConnectWise SkyKick Credentials to Access Microsoft 365, Halting Cloud Backups
   6. The Hacker News — ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants
   7. Forkast News — ConnectWise Cloud Backup Credential Abuse: 173 M365 Tenants Compromised in Trust-Through-Defaults Incident
   8. The Register — ConnectWise turns off its SaaS-y backup, security, and management services to probe security SNAFU
   9. iTnews — Stolen ConnectWise 'SkyKick' credential exposed Microsoft 365 tenants
   10. thehackernews.com — ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants
   11. www.helpnetsecurity.com — ConnectWise suspends Cloud Backup service after attackers abuse its Microsoft 365 access - Help Net Security
   12. www.securityweek.com — ConnectWise Suspends Cloud Services in Response to Cyberattack - SecurityWeek
   confidence 95%