ConnectWise security incident history
Hacking, data breaches and other security incidents involving ConnectWise, with related coverage.
ScreenConnect abuse compromises computers at 48 organisations
Impact: Remote access software installed on at least 288 computers across 48 organisations
Attackers exploited a cloud-based ScreenConnect management environment and third-party extensions to install remote access software for their use on at least 288 computers across 48 organisations. ConnectWise disabled five potentially related third-party extensions in approximately 400 partner environments. The company is investigating attacks targeting ScreenConnect users.
Related reports: 6 · last report →ConnectWise Cloud Breach Disrupts Services and Gives Access to Customer Environments
Impact: Backup, security and management services disrupted; successful logins confirmed to more than 300 customer Microsoft 365 tenants
ConnectWise's cloud environment was breached, disrupting its backup, security and management services in October 2026. Attackers used existing application permissions to access customers' Microsoft 365 environments, and Huntress confirmed successful logins to more than 300 tenants from related IP addresses. In response to unauthorised access to cloud backup application credentials, related accounts and credentials were reset. Microsoft later said login attempts using AI agents targeted more than 2,250 tenants.
Related reports: 5 · last report →ConnectWise breach puts ScreenConnect customers in attackers' sights
ConnectWise was breached in a cyber-attack, and ScreenConnect customers were targeted. A state-backed attacker was suspected of involvement, and the company confirmed the attack while stating that its systems were secure.
Related reports: 8 · last report →