# ConnectWise Halts Cloud Backup Amid Microsoft 365 Security Breach

*Published October 19, 2026*
*Source: [https://thehackernews.com/2026/10/connectwise-suspends-cloud-backup-after.html](https://thehackernews.com/2026/10/connectwise-suspends-cloud-backup-after.html)*

## Executive Summary

*This is a Premium edition. The Executive Summary is available to sec-news.ai members —*
*[read it here](https://www.sec-news.ai/news/connectwise-halts-cloud-backup-amid-microsoft-365-security-breach) or [see plans](https://www.sec-news.ai/pricing).*

## Article

ConnectWise has temporarily suspended its Cloud Backup service following a security breach where attackers gained unauthorized access to Microsoft 365 tenants. On October 17, 2026, ConnectWise disabled seven application identities and revoked certificates to prevent further unauthorized access. This action came after attackers used stolen ConnectWise Cloud Backup credentials to access 173 Microsoft 365 tenants, highlighting significant supply chain risks.

The company detected the breach on October 14, 2026, through advanced cybersecurity monitoring, which triggered an internal and external incident response. Although scheduled backups have been halted and access to affected archives remains unavailable, ConnectWise assures that existing data archives are encrypted and secure. The company has not observed additional malicious activity since October 15, but the investigation into the breach's root cause and the potential for further unauthorized activity continues.

The attack's severity lies in the misuse of application credentials, allowing attackers to access Microsoft 365 environments without individual password theft. With the stolen credentials, attackers could request access tokens based on existing permissions, potentially reaching other Microsoft services such as Exchange, SharePoint, and Teams. The attackers could also expand access by adding the application to the Global Administrator role.

Huntress, a security research firm, observed a second wave of attempts targeting specific sectors, although these efforts were unsuccessful. Huntress has also identified nearly 1,000 Entra tenants with activity from the unauthorized IP address, with 300 successful sign-ins. ConnectWise and Huntress continue to investigate and monitor for any further malicious activity.