ConnectWise Cloud Breach Disrupts Services and Gives Access to Customer Environments
ConnectWise's cloud environment was breached, disrupting its backup, security and management services in October 2026. Attackers used existing application permissions to access customers' Microsoft 365 environments, and Huntress confirmed successful logins to more than 300 tenants from related IP addresses. In response to unauthorised access to cloud backup application credentials, related accounts and credentials were reset. Microsoft later said login attempts using AI agents targeted more than 2,250 tenants.
Key facts
- Affected organisation
- ConnectWise
- Incident type
- Hacking & intrusion
- Occurred / detected
- Not confirmed
- Scale of damage
- Backup, security and management services disrupted; successful logins confirmed to more than 300 customer Microsoft 365 tenants
- Cause / method
- Unauthorised access to cloud backup application credentials and abuse of existing application permissions
- Location
- United States
Timeline
- ConnectWise suspended its cloud services in response to a cyber-attack.
- The service disruption continued, and Huntress confirmed successful logins to more than 300 customer tenants from related IP addresses.
- It emerged that, alongside the reset of related accounts and credentials, login attempts using AI agents had targeted more than 2,250 tenants.
5 related reports
- ConnectWise Suspends Cloud Services in Response to Cyberattack
- ConnectWise breach: Cloud services disruption continues three days after initial intrusion detected
- China-linked Warlock ransomware group targets global infrastructure
- China-Linked Cyberattack Forces Tampa’s ConnectWise to Shut Down Services
- ConnectWise Cloud Backup (formerly SkyKick) incident: AI-driven sign-in attempts against 2,250+ Microsoft 365 tenants, and what admins should check
Other incidents at ConnectWise
ScreenConnect abuse compromises computers at 48 organisations
Impact: Remote access software installed on at least 288 computers across 48 organisations
Attackers exploited a cloud-based ScreenConnect management environment and third-party extensions to install remote access software for their use on at least 288 computers across 48 organisations. ConnectWise disabled five potentially related third-party extensions in approximately 400 partner environments. The company is investigating attacks targeting ScreenConnect users.
Related reports: 6 · last report →ConnectWise breach puts ScreenConnect customers in attackers' sights
ConnectWise was breached in a cyber-attack, and ScreenConnect customers were targeted. A state-backed attacker was suspected of involvement, and the company confirmed the attack while stating that its systems were secure.
Related reports: 8 · last report →
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.