ConnectWise breach puts ScreenConnect customers in attackers' sights
ConnectWise was breached in a cyber-attack, and ScreenConnect customers were targeted. A state-backed attacker was suspected of involvement, and the company confirmed the attack while stating that its systems were secure.
Key facts
- Affected organisation
- ConnectWise
- Incident type
- Hacking & intrusion
- Occurred / detected
- Not confirmed
- Scale of damage
- Not confirmed
- Cause / method
- Targeted cyber-attack by a suspected state-backed actor
- Location
- United States
Timeline
- ConnectWise confirmed the ScreenConnect cyber-attack and said its systems were secure.
- A possible link between the ConnectWise breach and state-backed hackers came to light.
- It emerged that ScreenConnect customers had been targeted and that a targeted intrusion by a state-backed actor was suspected.
8 related reports
- Sovereign Hackers: Confronting the Rising Tide of Nation-State Cyberattacks
- ConnectWise Confirms ScreenConnect Cyberattack, Says Systems Now Secure: Exclusive
- ConnectWise breached in cyberattack linked to nation-state hackers
- ConnectWise Hit by Cyberattack; Nation-State Actor Suspected in Targeted Breach
- ConnectWise suffered a cyberattack carried out by a sophisticated nation state actor
- ConnectWise admits its MSP support software has been hacked
- ConnectWise Discloses Suspected State-Sponsored Hack
- ConnectWise Breached, ScreenConnect Customers Targeted
Other incidents at ConnectWise
ScreenConnect abuse compromises computers at 48 organisations
Impact: Remote access software installed on at least 288 computers across 48 organisations
Attackers exploited a cloud-based ScreenConnect management environment and third-party extensions to install remote access software for their use on at least 288 computers across 48 organisations. ConnectWise disabled five potentially related third-party extensions in approximately 400 partner environments. The company is investigating attacks targeting ScreenConnect users.
Related reports: 6 · last report →ConnectWise Cloud Breach Disrupts Services and Gives Access to Customer Environments
Impact: Backup, security and management services disrupted; successful logins confirmed to more than 300 customer Microsoft 365 tenants
ConnectWise's cloud environment was breached, disrupting its backup, security and management services in October 2026. Attackers used existing application permissions to access customers' Microsoft 365 environments, and Huntress confirmed successful logins to more than 300 tenants from related IP addresses. In response to unauthorised access to cloud backup application credentials, related accounts and credentials were reset. Microsoft later said login attempts using AI agents targeted more than 2,250 tenants.
Related reports: 5 · last report →
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.