ConnectWise Supply-Chain Attack Compromises Hundreds of Microsoft 365 Tenants

ConnectWise shut down multiple cloud services after threat actors exploited a sensitive API credential to breach hundreds of customer environments. The incident, identified as a supply-chain attack, allowed unauthorized access to Microsoft 365 applications linked to the vendor’s Cloud Backup service.

Researchers from Huntress reported that attackers used the stolen secret to compromise Exchange Online, Microsoft Teams, SharePoint Online, and other services. By late Saturday, Huntress detected sign-in activity from malicious infrastructure across almost 1,000 Entra tenants. More than 300 of those sign-ins appeared to succeed, according to Jonathan Semon, a principal security operations analyst at Huntress.

Scope of the Breach

ConnectWise confirmed unauthorized sign-ins in 162 tenants, noting that additional compromises likely exist beyond its own telemetry data. The cybersecurity firm, which primarily serves small- to mid-sized businesses, stated that hundreds of customers are confirmed impacted. The company has not provided a confirmed timeline for when all customers can regain full access to their data.

Microsoft Threat Intelligence reported observing broad successful sign-ins from a malicious IP address on October 15. The company noted that follow-on activity included reconnaissance using the Microsoft Graph API. Attackers also attempted to add additional credentials to service principals in target tenants to maintain direct access as a backdoor, Microsoft said in a LinkedIn post.

Service Disruptions and Response

ConnectWise suspended its Cloud Backup, SaaS Security, and Cloud Management services approximately two days after researchers first observed the wave of unauthorized sign-ins. The company temporarily halted these services on Saturday to contain the threat. A spokesperson stated that ConnectWise is continuing its investigation and remediation efforts following the unauthorized access to application identities associated with Cloud Backup, formerly known as SkyKick.

The company is monitoring its entire environment around the clock. In a security advisory, ConnectWise stated that since mitigations began on October 17 at 05:00 UTC, it has not observed successful threat activity in the environments it monitors. However, the company emphasized that this does not confirm whether individual partner or customer Microsoft 365 tenants were affected. Each potentially affected tenant still requires independent review, according to the advisory.

What should you do?

Organizations using ConnectWise Cloud Backup should verify their Microsoft 365 tenant status immediately. Administrators should check for unauthorized service principals or new credentials added to their environments. Users should monitor for unusual sign-in activity, particularly from unfamiliar IP addresses or locations.

Background: Threat intelligence program

A cyber intelligence program collects, analyzes, and distributes data about threats to help you defend your organization. It works by connecting external threat feeds to internal telemetry. You affect your security posture by prioritizing context over volume, ensuring every alert ties to a specific business risk or asset.

Read the full guide: Build a Cyber Intelligence Program That Cuts Noise and Finds Threats

What to do and how to stay safe: ConnectWise

• Review Microsoft Entra ID logs for any new service principals or credential additions that you did not authorize.
• Rotate any API secrets or application passwords that may have been exposed through third-party integrations.
• Monitor Microsoft 365 audit logs for unusual activity in Exchange Online, SharePoint, and Teams during the breach window.
• Enable multi-factor authentication for all administrative accounts if it is not already enforced.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Microsoft 365 services were compromised in the ConnectWise attack?

Attackers accessed Exchange Online, Microsoft Teams, SharePoint Online, Cloud Backup, MS Graph, and Partner Center.

How many tenants were affected by the ConnectWise supply-chain attack?

Huntress observed activity across nearly 1,000 tenants, with over 300 successful sign-ins, while ConnectWise confirmed 162 affected tenants.

Has ConnectWise restored its services after the breach?

ConnectWise suspended multiple services and has no confirmed timeline for full restoration, though it has not seen successful threat activity since October 17.