Microsoft 365 tenants breached through trusted ConnectWise identities
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Monday, October 19th, 2026.
Microsoft 365 tenants were compromised after unknown attackers gained unauthorized access to ConnectWise application identities. ConnectWise has suspended Cloud Backup and disabled seven identities while it investigates. The available disclosure doesn’t say how many tenants were affected, how the attackers gained access, or how long they remained inside, so the full scope is still unresolved.
Trusted application identities can hold broad permissions across customer cloud environments. If one is compromised, a single provider relationship can potentially become an incident across multiple tenants. Leaders should treat this as a third-party identity event, not only as a backup service outage. Defenders should identify ConnectWise-linked identities, review recent tenant activity, and preserve relevant logs before making changes. The supplied disclosure does not confirm any specific data loss.
The broader lesson is that service integrations need the same oversight as privileged human accounts. Inventory and restrict ConnectWise application access now, then investigate affected Microsoft 365 tenants for unauthorized activity.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
