Connect Wise Resets Credentials as Cloud Backup Remains Offline After Security Incident
Summary: ConnectWise reported unauthorized access to application identities tied to its Cloud Backup product, first identified on October 14, and said it began rolling out mitigations on October 17 at 5:00 a.m. UTC, since completing an account and credential reset in the affected environment and preparing for phased service restoration. Huntress, reviewing application sign-ins across more than 10,000 tenants with ConnectWise applications, found that only 144.172.64[.]128 and Microsoft-internal ranges produced application sign-in activity, and observed post-compromise actions on a second tenant where an application granted itself Global Administrator and added a new secret to a small number of other applications for persistence.
Why it matters: In both tenants Huntress reviewed, the same grant flow backdoored two completely different sets of applications, with the only consistent criterion being that credentials were planted in applications registered inside the affected tenant - so the blast radius is set by what an attacker can reach from any registered app, not by which app looks sensitive. ConnectWise also stated that its own finding of no successful threat activity does not establish whether individual partner or customer Microsoft 365 tenants were affected, leaving each tenant to review its own logs.
Read the original at The Hacker News ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026