ConnectWise Cloud Backup breach: unauthorized sign‑ins to at least 162 Microsoft 365 tenants on Oct 15, 2026
Event summary
ConnectWise suspended its Cloud Backup service on Oct 17, 2026 after investigators and third‑party telemetry found unauthorized application‑level sign‑ins from the ConnectWise Cloud Backup identity into customer Microsoft 365 tenants on Oct 15, 2026. Security vendor Huntress reported it had "identified at least 162 compromised tenants in its environment." ConnectWise states it "suspended Cloud Backup service, revoked certificates used for affected application connections across all users."
CHRONOS Wire · October 18 · Alert 1
Publication details
- Published
- Updated
- Revision
- r1
- Source
- BleepingComputer
Cliff Notes
- ConnectWise Cloud Backup app credentials used to sign into customer Microsoft 365 tenants on Oct 15; vendor paused service and revoked certificates on Oct 17; at least 162 compromised tenants reported by Huntress.
U.S. Impact
U.S. Impact assessment pending.
ELI5: Plain-English Explanation
A ConnectWise Cloud Backup application identity was used to sign into customer Microsoft 365 tenants on Oct 15, 2026; ConnectWise suspended the Cloud Backup service and revoked certificates on Oct 17 while investigating. Security vendors report at least 162 compromised tenants in their telemetry; administrators should assume app credentials/tokens could be abused and hunt for unauthorized application activity.
Why Urgent Level 4
App credentials and tokens can enable access to tenant data across many customers simultaneously; revoking affected credentials and hunting for unauthorized activity reduces additional exposure.
What Changed
Vendor status updates plus independent vendor telemetry show unauthorized application‑level sign‑ins from the ConnectWise Cloud Backup identity on Oct 15, 2026, and ConnectWise suspended the Cloud Backup service and revoked certificates on Oct 17, 2026.
What Is Genuinely New
ConnectWise suspended Cloud Backup connections and revoked affected certificates on Oct 17; independent telemetry from security vendors reports unauthorized sign‑ins on Oct 15 and at least 162 compromised tenants in one vendor's environment.
CHRONOS Bottom Line
ConnectWise Cloud Backup application credentials were used to sign into customer Microsoft 365 tenants on Oct 15; vendor paused service and revoked certificates on Oct 17. Administrators should review app registrations, revoke tokens/credentials for the ConnectWise Cloud Backup app, and hunt for unauthorized application activity.
Uncertainties / Known Unknowns
Exact total number of affected tenants is unclear; one vendor (Huntress) reported at least 162 compromised tenants but that count has not been independently enumerated. No public, specific confirmations of backup data exfiltration are present in the cited sources.
Detailed Analysis
SpecterOps and Todyl telemetry show the ConnectWise Cloud Backup application identity performed sign‑ins into customer Microsoft 365 tenants on Oct 15, 2026 (examples: 06:13–08:34 UTC per SpecterOps; 07:11–08:47 UTC per Todyl). Huntress reported identifying at least 162 compromised tenants in its environment. ConnectWise's status page states it suspended Cloud Backup service and revoked certificates on Oct 17 while investigating. Administrators should assume the application credentials and issued tokens could be abused until revoked and should review and revoke affected app registrations and tokens.
Sources / Evidence
- 01Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attackBleepingComputer2026-10-17
- 02ConnectWise Product and Services Status / AdvisoriesConnectWise (Trust Center / Status)2026-10-17
- 03ConnectWise SkyKick Breach: M365 Tenant CheckSpecterOps2026-10-17
- 04
Follow CHRONOS ALERTS
Published alerts also appear on Instagram and Threads as @chronosalerts.