2026 ConnectWise — Cloud Backup compromised API credential; 173+ M365 tenants accessed

2026 173 records affected

Data compromised

Customer M365 email, OneDrive files, SharePoint documents, Teams messages, directory data, application credentials, and secrets

Technical writeup

Password spraying on M365 accounts Oct 13-14. Compromised Cloud Backup API credential used to generate Graph tokens Oct 15 06:13-08:34 UTC, bypassing MFA. Attackers accessed 173+ tenants. In some tenants, escalated to admin roles and added persistence via new credentials. Service suspended Oct 17.

Root cause

Compromised OAuth application credential for Cloud Backup service; used to generate Microsoft Graph tokens and access customer M365 tenants.

References

https://thehackernews.com/2026/10/hackers-use-compromised-connectwise.html
https://www.rescana.com/post/connectwise-cloud-backup-supply-chain-attack-analysis-of-microsoft-365-tenant-compromise-and-mitigation-strategies

Data compromised

Technical writeup

Root cause

References

Breaches you may like