ConnectWise access breach reaches Microsoft 365 tenants
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Tuesday, October 20th, 2026.
ConnectWise is investigating stolen application credentials that were used to authenticate into Microsoft 365 tenants. The company suspended Cloud Backup, SaaS Security, and Cloud Management, then revoked affected certificates and credentials. Security firms observed successful sign-ins and, in a limited number of cases, new administrator access or credentials that could provide another route back into a tenant. Backups and restores also remained unavailable during the response.
For leaders, this combines possible Microsoft 365 compromise with the loss of a recovery service during an active investigation. For defenders, disabling the original ConnectWise application isn’t enough if an attacker already created separate credentials, roles, permissions, or mailbox changes. ConnectWise says its stored backup archives remain encrypted and that it has no evidence they were accessed. However, customers and managed service providers must review their own tenants because ConnectWise doesn’t have full visibility into those environments.
Preserve the available logs, disable the affected applications, and inspect every connected tenant for new credentials, elevated roles, permission changes, and other persistence.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
