Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants

Live updates

1. 2h ago

   Compromised ConnectWise Credential Hits 173 Microsoft 365 Tenants

   Unknown attackers used a stolen credential belonging to ConnectWise Cloud Backup, formerly SkyKick, to gain unauthorized access to 173 Microsoft 365 customer and partner tenants. The breach utilized delegated administrative privileges granted to the backup application, providing broad access to mailboxes, OneDrive, SharePoint, Teams, and directory data. The attack bypassed standard customer-side defenses such as multi-factor authentication and conditional access policies because it relied on a legitimate vendor-managed credential. ConnectWise has suspended its cloud backup services following the incident, while affected organizations scramble to revoke privileges and review audit logs for unauthorized activity.

   Why it matters

   The supply-chain campaign highlights the inherent risks of third-party vendor integrations that maintain broad administrative access across multiple cloud tenants. Because the intruders leveraged legitimate administration tools and valid application credentials, traditional perimeter defenses and user-level multi-factor authentication failed to block the unauthorized logins. Security researchers point out that such trust-through-defaults architectures pose severe cascading risks when a single vendor point of failure is compromised.

   What is confirmed

   • Attackers used a compromised ConnectWise Cloud Backup credential to gain unauthorized access to 173 Microsoft 365 partner and customer tenants.
   • The incident involved delegated admin privileges that granted broad access to mailboxes, OneDrive, SharePoint, Teams, and directory data.
   • The security event did not involve a software vulnerability in ConnectWise, but rather the compromise of a legitimate service account credential.
   • ConnectWise suspended its cloud backup services after the unauthorized access was discovered.

   Still unconfirmed

   • Some reporting indicates the unauthorized authentication activity occurred on October 15, 2026, between 06:13 and 08:34 UTC.

   What to watch next

   • Official incident reports from ConnectWise detailing the vector of the initial credential compromise
   • Further disclosures regarding potential data exfiltration from affected Microsoft 365 tenants
   • Updates on the restoration timeline for ConnectWise Cloud Backup services
   Sources used for this update (21)

   1. help.naver.com — Futures Flat As Oil Rebounds After Trump's "Energy Ceasefire" Unravels, Memory Stocks Slide | ZeroHedge
   2. The Hacker News — Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
   3. BleepingComputer — Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
   4. LinkedIn — WARNING: ConnectWise Supply-Chain Attack Exposes Microsoft 365 Tenants
   5. Cyber Press — ConnectWise SkyKick Credentials Abused in Microsoft 365 Attacks, Backup Services Shut Down
   6. CyberSecurityNews — Hackers used Compromised ConnectWise Backup Credentials to Hack 173 Microsoft 365 Accounts
   7. https://tech-insider.org/ — ConnectWise Cloud Backup Breach Hits 173 Tenants [2026]
   8. Rescana — ConnectWise Credential Compromise Enables Unauthorized Access to 173 Microsoft 365 Tenants: Cybersecurity Incident Analysis
   9. GBHackers News — Hackers Use ConnectWise SkyKick Credentials to Access Microsoft 365, Halting Cloud Backups
   10. The Hacker News — ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants
   11. thehackernews.com — Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
   12. cybersecuritynews.com — Hackers used Compromised ConnectWise Backup Credentials to ...
   confidence 95%