// Microsoft 365HIGH
ConnectWise shut down its Cloud Backup service after attackers accessed application identities and compromised at least 162–173 Microsoft 365 tenants. The malicious activity began October 15, 2026, involving unauthorized authentication and privilege escalation (e.g., Exchange Administrator role assignment). ConnectWise's cloud backup solutions use Microsoft Entra ID service principals to access customer tenants; the compromise exposed this trust relationship. Microsoft confirmed unauthorized authentication attempts; ConnectWise states backup archives appear uncompromised but investigation ongoing.
- Hackers breach Microsoft 365 tenants via ConnectWise supply-chai(opens in a new tab)
- One Compromised Vendor Credential, 173 Microsoft 365 Tenants: Th(opens in a new tab)
- ConnectWise Cloud Backup Credential Abuse: 173 M365 Tenants Comp(opens in a new tab)
- ConnectWise Cloud Backup Breach Hits 173 Tenants [2026](opens in a new tab)
- ConnectWise SkyKick breach: Microsoft 365 tenants hit(opens in a new tab)
- ConnectWise Suspends Cloud Services in Response to Cyberattack -(opens in a new tab)
// Get alerts for Microsoft 365