ConnectWise Suspends Cloud Backup Services After Tenants Compromised

ConnectWise disabled seven application identities on October 17, 2026, at 07:00 UTC, after discovering that unknown threat actors had obtained unauthorized access to those identities. The IT management software provider stated that these compromised identities were used to access and compromise Microsoft 365 tenants belonging to its customers. This action follows the company's detection of the issue on October 14, 2026, through its internal monitoring systems, which triggered immediate incident response procedures.

The seven disabled identities include ConnectWise Cloud Backup, ConnectWise Cloud Management, and specific modules for Microsoft Teams, Exchange Online, Microsoft Graph, Partner Center, and SharePoint Online. Each identity has a unique application ID string, such as 506e08f9-6e9a-4da4-942b-a099a03644ae for Cloud Backup. ConnectWise also suspended its Cloud Backup service by revoking the certificates used for affected application connections across all users, effectively halting new authentication attempts through those channels.

Impact on Services and Data

ConnectWise clarified that disabling these connections prevents new authentication but does not reverse changes already made inside affected Microsoft 365 tenants. Previously issued access tokens may remain usable until they expire or are otherwise invalidated by the tenant administrators. The company emphasized that any unauthorized credentials, permissions, or other access established through separate identities require additional review and remediation by the affected customers. Scheduled backups are not running, and access to affected backup archives and restoration capabilities remains unavailable during this suspension.

Despite the suspension of services, ConnectWise stated that existing backup archives remain encrypted, isolated, and preserved. The company reported no evidence that these archives were breached or accessed by the attackers. Out of an abundance of caution, ConnectWise temporarily took its SaaS Security and Cloud Management platforms offline while it completes its review of the incident. Since implementing these mitigations, ConnectWise has not observed successful threat activity in the environments it directly monitors.

Scope of the Incident

ConnectWise noted that its findings do not establish the status of downstream customer environments, which it cannot directly observe by design. As Threat Times reported earlier, hackers exploited a compromised ConnectWise credential to access 173 Microsoft 365 tenants, bypassing user authentication and planting persistent access tokens. This earlier reporting aligns with the current suspension of services, as the company works to contain the spread of unauthorized access across its customer base. The investigation into the full scope of the compromise remains ongoing.

What should you do?

ConnectWise customers using Microsoft 365 should verify the status of their backup services and check for any unauthorized access tokens or permissions in their tenant environments. Administrators should review application identities and revoke any that are not recognized or necessary. Organizations should monitor their Microsoft 365 activity logs for suspicious authentication attempts or changes to user permissions. Once the vendor provides an update, customers should follow the recommended remediation steps to secure their environments.

What to do and how to stay safe: ConnectWise

• Review Microsoft 365 tenant activity logs for unauthorized access tokens or permission changes related to ConnectWise application identities.
• Verify that scheduled backups are running and that backup archives are intact and accessible after service restoration.
• Revoke any unknown or unnecessary application identities and credentials in your Microsoft 365 environment to reduce exposure.
• Monitor for any persistent access tokens that may remain valid until expiration and invalidate them proactively if possible.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did ConnectWise confirm that attackers accessed backup archives?

No, ConnectWise stated there is no evidence that existing backup archives were breached or accessed by the attackers.

What services did ConnectWise suspend?

ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management services while investigating the incident.

How did ConnectWise detect the issue?

ConnectWise identified the issue on October 14, 2026, through its advanced cybersecurity monitoring and diligence systems.