CONNECTWISE disclosed that it disabled seven application identities after attackers gained unauthorized access to ConnectWise application identities and breached customers’ Microsoft 365 tenants. The affected identities include ConnectWise Cloud Backup and several ConnectWise Cloud Management apps across MS Teams, Exchange Online, MS Graph, Partner Center and SharePoint Online.
The action was taken on 17 October 2026 at 07:00 UTC, and the company also suspended Cloud Backup service by revoking certificates used for the affected connections. ConnectWise stressed that disabling the connections prevents new authentication but does not reverse changes already made inside a tenant; previously issued access tokens may remain valid until expiry or invalidation, and other compromised identities require further review and remediation.
The incident is described as dangerous because an attacker could use stolen application credentials to authenticate as the application itself against customers’ Microsoft 365 environments, potentially gaining access to mail, SharePoint documents, Teams messages and directory information. ConnectWise said scheduled backups are not running and restoration access to backup archives is unavailable, though existing archives remain encrypted, isolated and preserved with no evidence of breach to date.
Huntress reported a second, targeted wave of attempts on 15 October, affecting around 16 tenants, including abuse of the Teams app in one tenancy. They advise organisations to review tenants (including dormant SkyKick connections), verify application connections, monitor sign-ins from the specified IP range, and review credentials, federation trusts, roles and mailbox rules to detect any persistence or further access opportunities.