ConnectWise Suspends Cloud Backup After Microsoft 365 Tenant Compromise

What happened

On October 17, 2026, ConnectWise announced that seven of its application identities had been compromised by unknown threat actors. The breach allowed attackers to gain unauthorized access to Microsoft 365 tenants that were managed through ConnectWise’s Cloud Backup and Cloud Management services.

ConnectWise immediately disabled the affected identities and revoked the certificates that were used to authenticate connections to Microsoft 365 services. The company also suspended its Cloud Backup service across all users, preventing new backups from being created and blocking access to existing backup archives.

Who is affected

Any organization that uses ConnectWise’s Cloud Backup or Cloud Management solutions to protect Microsoft 365 workloads is potentially impacted. The identities that were disabled cover a range of services, including Exchange Online, SharePoint Online, Microsoft Teams, and the Microsoft Graph API.

Customers who had previously configured automated backups through ConnectWise will find that scheduled jobs have stopped running. While the backup data itself remains encrypted and isolated, administrators cannot restore from those archives until the service is re‑enabled.

Impact

The immediate effect is a loss of backup continuity for affected tenants. Without new backups, any data loss or ransomware event occurring after the suspension could leave customers with no recent recovery point.

Additionally, the compromise may have granted attackers elevated permissions within the Microsoft 365 tenants. Although ConnectWise states that no evidence of data exfiltration has been found, the potential for unauthorized changes to tenant configurations or user accounts remains.

Exposure

ConnectWise identified the breach on October 14, 2026, after detecting anomalous activity associated with the compromised identities. The attackers used these identities to authenticate to Microsoft 365 services, creating or modifying access tokens that could persist until they expire.

Because the compromised identities were linked to critical Microsoft 365 APIs, the threat actors had the ability to read, write, and delete data across Exchange, SharePoint, Teams, and other services. The exact scope of the damage is still under investigation, but the potential for widespread exposure is significant.

What to do

• Verify whether your organization is using any of the seven disabled ConnectWise identities listed in the announcement.
• Check the status of scheduled backups in the ConnectWise portal; if they have stopped, plan to restore from the most recent available archive.
• Review Microsoft 365 audit logs for any unusual sign‑ins or permission changes that coincide with the breach window.
• Revoke any long‑lived access tokens issued by the compromised identities and issue new tokens with the least privilege necessary.
• Enable multi‑factor authentication for all privileged accounts in your Microsoft 365 tenant.
• Consider temporarily disabling or re‑configuring any automated backup processes until ConnectWise confirms the service is secure.
• Contact ConnectWise support for a detailed list of affected tenants and any recommended remediation steps.

What to watch

ConnectWise is conducting a full review of the incident and has taken its SaaS Security and Cloud Management services offline. Keep an eye on official communications for updates on when the services will be restored and any changes to the affected identities.

Security teams should monitor for signs of lateral movement or data exfiltration within their Microsoft 365 environments, especially around the time of the breach. Stay alert for any new advisories or patches that address the underlying vulnerability that allowed the compromise.