ConnectWise Suspends Cloud Backup Services After Stolen API Secret Enables Access to Customer Tenants
Summary
ConnectWise suspended Cloud Backup and related services while probing attackers’ use of a stolen M365 API secret to access customer tenants. Huntress reported 300 successful sign-ins among nearly 1,000 attempts; data access remains unclear.
Key points
- ConnectWise said it detected unauthorized activity and hired a third-party incident response firm; Huntress linked the incident to a compromised Microsoft 365 API secret for Cloud Backup.
- Huntress reported nearly 1,000 attempted sign-ins across its customers’ M365 tenants, with 300 succeeding. Successful sign-ins do not establish that data was accessed or copied.
- Attackers allegedly used app access to add credentials to other trusted applications, including an MSP management app and Huntress’s security app, and obtained global administrator rights for a ConnectWise Teams app.
- ConnectWise disabled Cloud Backup and six interconnected cloud services, disrupting backup and restoration. The company said existing backup archives were not affected.
- ConnectWise and Huntress advised investigating every managed tenant for suspicious app credentials, grants, identities, and ongoing access; vendor-side revocations do not automatically change customer tenant configurations.
- The scope of the incident and what attackers did after successful sign-ins remain unclear. Huntress said some activity may not be fully visible in Microsoft logs.
Article Details
- Victim Organization
- ConnectWise; downstream customer organizations using ConnectWise services were also targeted, but are not named.
- Incident Type
- Compromised Microsoft 365 API secret associated with ConnectWise Cloud Backup was used to gain unauthorized access to customer Microsoft 365 environments. Attackers also reportedly added credentials to other trusted applications.
- Disclosure Date
- 2026-10-16
- Operational Impact
- ConnectWise disabled Cloud Backup and six interconnected services, disrupting backup and restoration until services are restored. ConnectWise said existing backup archives were not impacted. Huntress reported nearly 1,000 attempted sign-ins against its customers’ Microsoft 365 tenants, with 300 successful; whether data was accessed or copied was not established.
- Claim Status
- confirmed
MITRE ATT&CK
People
Vendors
ConnectWiseConnectWise Suspends Cloud Backup Services as It Probes HackHuntresscompromised and "used to gain unauthorized access to customers' M365 environments," cybersecurity firm Huntress said in a report first released Friday, which was subsequently updated.MicrosoftThe Florida company's Backup tool is widely used, including by managed service providers, to backup and restore clients' Microsoft 365 and Google Workspace data.
Products
ConnectWise Cloud Backupincident involves, at least in part, "a Microsoft 365 credential (API secret) belonging to ConnectWise Cloud Backup" being compromised and "used to gain unauthorized access to customers' M365 environments,"Google WorkspaceThe Florida company's Backup tool is widely used, including by managed service providers, to backup and restore clients' Microsoft 365 and Google Workspace data.Microsoft 365 Apps for EnterpriseThe Florida company's Backup tool is widely used, including by managed service providers, to backup and restore clients' Microsoft 365 and Google Workspace data.Microsoft Entra IDgave themselves "global administrator" rights, which is the highest level of access possible, in Microsoft Entra ID for the ConnectWise app named Cloud Management - MS Teams, which has since been suspended.
Industries
National securityday, it found a second wave of attacks began that targeted 16 of its customers across "the policy, national security, trade and critical mineral sectors," which failed because the targeted organizations didn't usePolicyLater that day, it found a second wave of attacks began that targeted 16 of its customers across "the policy, national security, trade and critical mineral sectors," which failed because the targeted organizationsTradea second wave of attacks began that targeted 16 of its customers across "the policy, national security, trade and critical mineral sectors," which failed because the targeted organizations didn't use ConnectWise