ConnectWise Pauses Cloud Backup and Other Services After Attackers Reach Microsoft 365 Tenants

ConnectWise, a provider of IT management software, said it has disabled seven of its application identities while it investigates an incident. Unknown threat actors obtained unauthorised access to those identities and compromised Microsoft 365 tenants. The company took action on October 17, 2026, at 07:00 UTC, and also suspended its Cloud Backup service by revoking certificates used for the affected application connections across all users. It first identified the issue on October 14, 2026, through its security monitoring.

The company stressed that disabling the connections stops new sign-ins through them but does not undo changes already made inside a tenant. Previously issued access tokens may keep working until they expire or are invalidated, and any unauthorised credentials or permissions created through separate identities need further review. Scheduled backups are not running, and access to backup archives and restores is unavailable. ConnectWise says the archives remain encrypted, isolated and preserved, with no evidence they were accessed. As a precaution, it has also taken SaaS Security and Cloud Management offline.

ConnectWise said it has not seen successful threat activity in the environments it monitors since applying its mitigations, but it cannot directly see customer environments. It is still unclear whether a product vulnerability played a part, and the way the credentials were exposed remains under analysis.