Connect Wise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants
Summary: ConnectWise disabled seven of its application identities on October 17, 2026, at 07:00 UTC and suspended its Cloud Backup service by revoking certificates after unknown attackers obtained unauthorized access to those identities and compromised Microsoft 365 tenants. The company identified the issue on October 14, 2026, and has also taken SaaS Security and Cloud Management offline; Huntress found almost 1,000 Entra tenants with sign-in activity from the associated IP address, of which 300 succeeded.
Why it matters: A stolen application credential lets an attacker authenticate as the app itself and request Entra ID tokens without stealing a single customer password, and Huntress confirmed abuse of the Teams app in one tenant among apps ConnectWise did not appear to disable. With 300 successful sign-ins across nearly 1,000 tenants and a second wave aimed at 16 tenants in the policy, national security, trade, and critical mineral sectors, the planted client secrets can outlast revocation of the original credential.
Read the original at The Hacker News ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026