ConnectWise Suspends Cloud Backup After Unauthorized Access to Application Identities
Summary
ConnectWise disabled seven application identities and suspended Cloud Backup after unknown actors gained unauthorized access and compromised Microsoft 365 tenants. The weekly recap also lists numerous trending CVEs, but gives little detail on them.
Key points
- ConnectWise said unknown threat actors gained unauthorized access to seven application identities and compromised Microsoft 365 tenants.
- On October 17, 2026, ConnectWise disabled the identities and suspended Cloud Backup by revoking certificates used for affected application connections across all users.
- ConnectWise said its investigation is ongoing.
- The recap lists numerous CVEs affecting products from vendors including Microsoft, Google, Adobe, and Cisco, but provides little vulnerability-specific context or remediation detail.
Article Details
- Event Type
- Unauthorized access to ConnectWise application identities, followed by compromise of Microsoft 365 tenants; ConnectWise suspended the affected identities and Cloud Backup service.
- Impact
- Unknown threat actors obtained unauthorized access to seven ConnectWise application identities and compromised Microsoft 365 tenants. ConnectWise revoked certificates used for affected application connections across all users and suspended Cloud Backup while investigating.
Vendors
Products
ConnectWise Cloud BackupConnectWise Suspends Cloud Backup Following Unauthorized Access — ConnectWise disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtainedMicrosoft 365 Apps for Enterpriseunknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenants. The IT management software provider said it took the action on October 17, 2026, at 07:00