ConnectWise has temporarily disabled several application identities following a significant security breach involving unauthorized access to Microsoft 365 tenants. This incident, identified on October 14, 2026, led to the suspension of the company’s Cloud Backup service as a precautionary measure.
Details of the Security Breach
The breach involved unknown attackers who compromised the application identities associated with ConnectWise’s services, including Cloud Backup and various management tools. ConnectWise responded by disabling seven specific applications and revoking certificates to prevent further unauthorized access. This action affects all users connected to these applications.
Although the company has halted scheduled backups and restricted access to affected archives, it reassured users that existing data remains secure and encrypted. The investigation is ongoing, with no evidence yet of data breaches within stored archives.
Analysis and Immediate Measures
ConnectWise’s swift response included taking additional SaaS Security and Cloud Management services offline while they conducted a thorough review. Despite the breach, the company notes no new unauthorized activities have been detected in their monitored environments since mitigation measures were enacted.
However, the precise method of credential exposure remains under investigation. Initial findings suggest the attackers exploited application credentials to access multiple Microsoft 365 services, potentially expanding their reach to other connected resources.
Impact and Recommendations for Users
Security experts continue to assess the breach’s impact, particularly concerning the potential misuse of extensive permissions granted to ConnectWise applications. These permissions, if exploited, could allow attackers to escalate privileges and maintain persistence in compromised environments.
To safeguard against future threats, ConnectWise advises partners to conduct comprehensive reviews of their Microsoft 365 environments. This includes checking sign-ins, application permissions, and maintaining a robust audit trail to identify suspicious activities.
Additionally, the company highlights the importance of implementing stringent application management policies and conditional access controls to limit potential damage from stolen credentials. These measures, while not foolproof, enhance security by reducing the risk associated with unauthorized access.
The breach underscores the critical need for ongoing vigilance and proactive security strategies in managing cloud-based services and sensitive data.
