ConnectWise Suspends Cloud Services in Response to Cyberattack

ConnectWise experienced a cyberattack where a compromised Cloud Backup credential was used to access Microsoft 365 tenants between October 15 and 16, 2026. The attacker leveraged a client assertion credential residing in ConnectWise's tenant to authenticate into at least 162 Microsoft 365 tenants, originating from an IP address previously used in password spraying attacks. The attacker performed scripted sign-ins in sorted GUID order, indicating automated targeting. Privilege escalation was observed in at least one tenant, where the ConnectWise Cloud Management app added itself to the Global Administrator role and created new client secrets. ConnectWise responded by suspending Cloud Backup, SaaS Security, and Cloud Management services to mitigate the attack. The company confirmed backups remain encrypted and protected, with no evidence of unauthorized access to backup data. The incident is ongoing with remediation and security validation in progress.

The attack resulted in unauthorized access to Microsoft 365 tenants via compromised ConnectWise Cloud Backup credentials, potentially exposing tenant configurations and administrative privileges. Although backups remain encrypted and protected with no evidence of compromise, the incident disrupted Cloud Backup, SaaS Security, and Cloud Management services, impacting scheduled backups, archive access, restores, monitoring, alerting, and user/license management. The attacker gained elevated privileges in some tenants, which could allow configuration changes or persistence mechanisms. The full extent of tenant-level impact depends on individual tenant configurations and whether the ConnectWise service principals were present.

ConnectWise has suspended the affected cloud services to contain the attack and is conducting remediation and security validation. Customers should review their Microsoft 365 tenant configurations for unauthorized changes or persistence mechanisms, especially focusing on service principals and administrative roles related to ConnectWise applications. ConnectWise has published guidance for MSPs to review their Microsoft 365 environments. There is no evidence of backup data compromise, and backups remain encrypted and protected. No official patch is applicable as this is a credential compromise incident. Organizations should follow ConnectWise's updates and guidance for restoration timelines and further remediation steps.