Hackers Used Stolen ConnectWise Credentials to Access 173 Microsoft 365 Accounts

What happened to ConnectWise Cloud Backup customers

According to The Hacker News↗ (opens in a new tab), attackers got hold of a Microsoft 365 credential used by ConnectWise Cloud Backup. This service is popular with managed service providers (MSPs) and is used to back up Microsoft 365 data for many organisations. The attackers used the stolen credential to sign in to 173 different customer and partner Microsoft 365 accounts (known as "tenants").

The attackers moved through these tenants in a methodical way, using a script to access each one a few seconds apart. The activity was first spotted on 15 October 2026. The attackers used the same permissions as the backup tool itself, which has broad access to emails, files, Teams chats and directory data in each tenant where it is installed.

What data was at risk

Because ConnectWise Cloud Backup needs wide access to do its job, the attackers could use its permissions to read mailboxes, OneDrive and SharePoint files, Teams messages, and directory information. In at least one case, the attackers used another ConnectWise app to give themselves Global Administrator rights and add credentials to other trusted apps. This could have let them move further into customer environments and gain even more access.

Security researchers at Huntress and Todyl both observed these unauthorised sign-ins. Huntress found that the attackers used their own tools to request tokens (digital keys that grant access) with the app’s existing permissions. Todyl confirmed that the attackers could read and write emails and files, and even restore data, as long as the app was enabled.

How ConnectWise and researchers responded

ConnectWise has closed access to the Cloud Backup app until further notice. The company says it has not found evidence that customer backup data was stolen. It has published advice for customers, including how to check for suspicious sign-ins and what application IDs to look for in Microsoft Entra Admin Center logs.

Researchers recommend disabling the app until ConnectWise resets all credentials. They also suggest enabling Microsoft Graph activity logs, auditing for new credentials added since 13 October 2026, and checking for ConnectWise or SkyKick apps adding themselves to directory roles.

How the attack worked

The attackers used a stolen credential to authenticate as the ConnectWise Cloud Backup app. This let them inherit all the permissions the app had in each tenant. Revoking user sessions did not stop this access. Disabling the app in a tenant stopped new tokens from being issued, but any tokens already issued could still be used for up to 90 minutes. The attackers also used a Python script to add credentials to other privileged applications, which could extend their reach.

What customers should do now

If you use ConnectWise Cloud Backup, check your Microsoft 365 sign-in logs for suspicious activity from unfamiliar IP addresses, especially those outside normal Microsoft or Azure ranges. Disable the app until ConnectWise confirms it is safe. Audit your environment for new credentials or changes to app permissions since 13 October 2026. Enable logging to help spot any future suspicious activity.

This incident shows how a single compromised credential in a widely used cloud service can put many organisations at risk. It also highlights the importance of monitoring third-party app permissions and regularly auditing access rights.