Monday, October 19, 2026 --:--:-- ET
New York 62°F Partly cloudy Los Angeles 78°F Sunny Chicago 55°F Windy
Subscribe
U.S. Edition Est. 2026 Oct. 19, 2026

US News America

Independent reporting for a changing America

Breaking
Angel Reese Scores 30 Points as Dream Beat Valkyries 79-65 to Even WNBA Finals 1-1 Supreme Court Agrees to Decide Whether Americans Can Legally Distill Liquor at Home Ukraine Flies Wounded Soldier Off the Front Line by Drone in What It Calls a World-First Rescue ConnectWise Suspends Cloud Backup After Hackers Used Compromised Credentials to Breach Microsoft 365 Tenants AI Can Estimate Cancer Survival From a Single Face Photo, Mass General Brigham Study Says
Technology

ConnectWise Suspends Cloud Backup After Hackers Used Compromised Credentials to Breach Microsoft 365 Tenants

The IT management software company shut down its Cloud Backup, SaaS Security, and Cloud Management services after Microsoft and cybersecurity researchers said attackers used a stolen credential to sign into customer Microsoft 365 tenants.

By admin Oct. 19, 2026 · 9:50 PM ET 2 min read

A modern glass office building on a sunny day.
A modern glass office building on a sunny day.

ConnectWise has suspended its Cloud Backup service after a suspected supply-chain attack in which hackers used a compromised credential to break into customer Microsoft 365 environments, the company said. The attack was first detected on Wednesday.

The Tampa, Florida-based company, whose software is used by managed service providers to manage client IT systems, also suspended its SaaS Security and Cloud Management services because they are connected to Cloud Backup, formerly known as SkyKick.

A ConnectWise spokesperson told Cybersecurity Dive there is no evidence that partner backup data has been compromised.

How the intrusion worked

Rows of server racks with blue and green indicator lights in a dark data center.

Cybersecurity firm Huntress said a compromised user credential for ConnectWise Cloud Backup was used to gain unauthorized access to Microsoft 365 tenants. The firm confirmed unauthorized sign-ins in 162 customer tenants in a blog post released Friday, according to Cybersecurity Dive.

A silhouetted analyst seen from behind, sitting at a desk in front of a wall of monitors showing network graphics.

The attackers tried to sign into more than 1,000 Microsoft 365 customer accounts protected by Huntress and succeeded in more than 300 of them, Jon Semon, a principal security operations analyst at the firm, told Cybersecurity Dive.

Microsoft Threat Intelligence said Saturday it was tracking an active supply-chain attack involving a trusted OAuth application for ConnectWise Cloud Backup. Microsoft said the attackers had likely abused permissions that customers had previously granted to the application. The company detected “broad successful principal authentication” on Thursday and also picked up Microsoft Graph API reconnaissance, plus attempts by the attackers to add new credentials to keep access as a backdoor.

What affected customers are being told to do

A laptop on a desk showing blurred lines of code and a login dialog on its screen.

Cybersecurity platform Todyl separately confirmed impacts from the same attack, saying the intruder used a valid credential to sign into Microsoft 365 tenants.

ConnectWise told security teams to preserve available sign-in and audit records, review application authentication and credentials, check for unauthorized mailbox forwarding, inbox rules or delegated mailbox access, and investigate any other identities that changed during suspicious activity.

Reporting based on coverage by Cybersecurity Dive.

Related Stories