October 17-18, 2026: ConnectWise suspended its Cloud Backup and Cloud Management services after discovering that a compromised API credential was used to access and exfiltrate data from at least 173 Microsoft 365 customer tenants. Attackers gained access to emails, OneDrive files, SharePoint documents, Teams messages, and directory information. In some tenants, attackers escalated to Global Administrator and Exchange Administrator roles. Canonical: connectwise-cloud-backup-breach2026. Source: The Hacker News.
What happened
On October 13-14, 2026, attackers performed password spraying against Microsoft 365 accounts belonging to law firms using ConnectWise Cloud Backup. On October 15 at 06:13-08:34 UTC, attackers used a compromised Cloud Backup API credential to generate Microsoft Graph tokens, granting access to customer tenants without triggering MFA. ConnectWise detected the malicious token generation from IP 144.172.64.128, disabled 7 affected application identities, and suspended all Cloud Backup and Cloud Management services on October 17. Investigation was ongoing as of October 18.
Technical analysis
The attack exploited a compromised OAuth application credential belonging to ConnectWise Cloud Backup. This credential had permission to generate Microsoft Graph tokens on behalf of customer tenants, effectively bypassing multi-factor authentication. The attacker used this to impersonate the legitimate Cloud Backup service and access M365 data directly.
Data accessed: Email messages and attachments, OneDrive files, SharePoint files, Teams messages and data, directory information, application credentials and secrets stored in M365. Limited to: No evidence that encrypted backup archives themselves were accessed (backups are encrypted with customer keys).
In some tenants, attackers escalated to Global Administrator and Exchange Administrator roles, added new client secrets for persistence, and potentially downloaded large amounts of data.
Impact
Scope: At least 173 Microsoft 365 customer tenants confirmed compromised, with potential for many more. Law firms were primary targets, but any organization using ConnectWise Cloud Backup is at risk. Organizations using ConnectWise Cloud Backup for data backup and disaster recovery have no access to their backup data while the service remains suspended.
Risks: Email theft (business communications, credentials, trade secrets, client confidential information), file theft (contracts, financial records, litigation strategy documents), credential compromise (attackers obtained API secrets, OAuth tokens, and admin credentials for persistence), operational disruption (cloud backup and restore services unavailable), account compromise (attackers can send emails from compromised accounts), and data exfiltration (large-scale downloads of M365 data).
This is a critical supply-chain incident because ConnectWise sells to managed service providers (MSPs), who use it to manage customer environments. Compromise of the ConnectWise service potentially affects organizations downstream of the MSP relationship.
What to do
- Check for malicious email activity: Review mailbox activity logs and message traces from Oct 13-17 for suspicious forwarding rules, delegates, or sent items.
- Reset all API keys and secrets: If you use ConnectWise or other cloud services with M365, rotate all application credentials and API keys.
- Review admin role assignments: Check Global Admin, Exchange Admin, and other privileged roles in your M365 tenant; remove unauthorized accounts.
- Scan for persistence: Look for newly created service principals, OAuth apps, or registered applications that weren't deployed by you.
- Monitor account activity: Check for new sign-in locations, unusual time-of-day patterns, or MFA bypass in your tenant logs.
- Enable enhanced logging: Configure Unified Audit Log (UAL) retention and review for suspicious activities during the Oct 13-17 window.
Related reading
See supply-chain attack prevention.
Sources
The Hacker News • RESCANA • Huntress