ConnectWise suspends Cloud Backup after tenant compromise

ConnectWise said on Saturday that it had disabled seven application identities after unknown threat actors gained unauthorised access and compromised Microsoft 365 tenants. It said the action was taken on 17 October 2026 at 07:00 UTC.

The company said it had also suspended Cloud Backup by revoking certificates used for affected connections across all users. It said scheduled backups were not running, and that access to backup archives and restoration functions remained unavailable.

ConnectWise said the existing archives stayed encrypted, isolated and preserved, and that it had seen no evidence they were breached or accessed. It also said it had taken SaaS Security and Cloud Management offline while it completed its review.

The company said it identified the issue on 14 October 2026 and had not observed successful threat activity in the environments it monitors since the mitigations were put in place. It added that it could not directly observe downstream customer environments, and that the mechanism of credential exposure was still under analysis.

Huntress’ Jon Semon said malicious sign-ins from the original address continued until 15 October, and that a second targeted wave hit 16 tenants later that day. He said the later wave appeared manual, affected tenants in policy, national security, trade and critical mineral sectors, and included confirmed abuse of the Microsoft Teams app in one tenant.