ConnectWise Resets Credentials After Attackers Accessed Cloud Backup Identities
The IT service provider is replacing application credentials and strengthening admin protections after unauthorized access to its Cloud Backup service identities.
Key points
- ConnectWise has reset accounts and replaced application credentials following a security incident involving its Cloud Backup service.
- The company suspended Cloud Backup and precautionarily halted SaaS Security and Cloud Management services while investigating the breach.
- Huntress disclosed IP addresses linked to the activity, noting that some failed login attempts may not be related to the primary application sign-in vector.
ConnectWise announced on Monday that it has implemented remediation measures, including resetting user accounts and replacing application credentials, in response to a security incident. The company stated that attackers gained unauthorized access to application identities associated with its Cloud Backup service, prompting these immediate containment actions.
The vendor began rolling out mitigations on October 17 at 5:00 a.m. UTC, three days after first identifying the incident. ConnectWise reported that it has since disabled affected application connections and suspended the Cloud Backup service entirely. It also suspended SaaS Security and Cloud Management as a precautionary measure because those platforms are integrated with Cloud Backup.
Incident Response and Technical Details
ConnectWise enlisted independent third-party specialists to assist with incident response and remediation efforts. The company said it is currently validating the effectiveness of its containment measures and emphasized that it has not observed any successful threat activity in the environments it directly monitors. There is no evidence that any ConnectWise products or services, other than Cloud Backup and the two precautionary suspensions, are impacted by this incident.
Huntress shared specific IP addresses observed in connection with the activity, according to reporting by The Hacker News. Huntress noted that password spray and failed login attempts linked to some of these addresses are unlikely to be related to the primary application sign-in activity. The primary vector involved application sign-ins using a vendor credential from the IP 144.172.64[.]128.
Other observed activity included concentrated failed user password sprays from 144.172.64[.]99 between October 10 and 14, 2026. A few failed user logins were recorded from 144.172.64[.]60 on October 18, 2026. Additionally, broad failed login sprays against many organizations were ongoing from 144.172.94[.]243.
Impact on Partners and Customers
ConnectWise warned that its internal observations do not establish whether individual partner or customer Microsoft 365 tenants have been affected. The company stated that reviewing each potentially affected tenant remains essential for partners and managed service providers. This follows earlier reporting by Threat Times on October 19, 2026, which noted that ConnectWise had halted cloud backups after researchers found attackers using its credentials to authenticate into Microsoft 365.
The vendor published technical guidance to help partners investigate and remediate potential unauthorized activity in their own and managed customer environments. ConnectWise advised that before making changes, users should preserve relevant evidence, validate findings, and assess potential operational impacts. Completing these steps does not guarantee that a tenant is unaffected or that all unauthorized access has been eliminated.
ConnectWise explicitly instructed partners not to reconnect affected applications until the company provides formal restoration instructions. The company stressed that the incident remains under active investigation and that partners should rely on official guidance rather than attempting independent remediation without proper validation.
What should you do?
Partners and customers using ConnectWise Cloud Backup should monitor their Microsoft 365 tenants for suspicious sign-in activity, particularly from the IP addresses disclosed by Huntress. Organizations should review administrative access logs for any unauthorized changes or new application registrations. Users should wait for formal restoration instructions from ConnectWise before re-enabling suspended services or reconnecting affected applications.
What to do and how to stay safe: ConnectWise
- Review Microsoft 365 sign-in logs for activity originating from the IP addresses 144.172.64[.]128, 144.172.64[.]99, 144.172.64[.]60, and 144.172.94[.]243.
- Preserve evidence of any suspicious activity and validate findings before making changes to tenant configurations or application permissions.
- Do not reconnect affected applications or resume suspended services until ConnectWise provides formal restoration instructions.
- Assess operational impacts and consult independent incident response specialists if unauthorized activity is detected in managed environments.
Step-by-step guide: Cloud Misconfiguration Response: Containment, Recovery and Prevention Steps
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What services did ConnectWise suspend due to the security incident?
ConnectWise suspended Cloud Backup and precautionarily suspended SaaS Security and Cloud Management because they are integrated with Cloud Backup.
Are there any known indicators of compromise for this incident?
Huntress identified four IP addresses, with 144.172.64[.]128 linked to application sign-ins using a vendor credential as the primary vector.
Has ConnectWise confirmed that customer data was exfiltrated?
ConnectWise stated it has not seen successful threat activity in monitored environments but noted that individual tenant impact remains unconfirmed.
