ConnectWise announced on Saturday that it has disabled seven ConnectWise application identities as part of an ongoing investigation into an incident where unauthorized access was gained by unknown threat actors, compromising Microsoft 365 tenants.
The disabled identities are as follows:
- ConnectWise Cloud Backup – 506e08f9-6e9a-4da4-942b-a099a03644ae
- ConnectWise Cloud Management – 2399d300-6fca-4e6a-a686-399fefe75b83
- ConnectWise Cloud Management – MS Teams – 24205314-2b89-4e07-a2a4-579e898a5640
- ConnectWise Cloud Management – Exchange Online – b78f6a77-d4e5-46fb-87e5-d1648bd02519
- ConnectWise Cloud Management – MS Graph – 0de14c77-b9b0-4137-9360-34878a929827
- ConnectWise Cloud Management – Partner Center – 412dcf96-176d-4b3a-a1b0-4981ad66971e
- ConnectWise Cloud Management – SharePoint Online – b2b55f5b-7758-4719-8d8f-88ae172e6bdb
ConnectWise took action on October 17, 2026, at 07:00 UTC, and also suspended the Cloud Backup service by revoking certificates used for affected application connections across all users.
“Disabling the affected connections prevents new authentication through those connections; it does not reverse changes previously made inside a tenant,” the company stated.
The company emphasized that scheduled backups are not running, and access to affected backup archives and restoration capabilities remains unavailable. However, existing archives are encrypted, isolated, and preserved, with no evidence of breach or unauthorized access.
As a precautionary measure, ConnectWise temporarily took SaaS Security and Cloud Management offline while conducting a thorough review of the incident.
Furthermore, the company identified the issue on October 14, 2026, through advanced cybersecurity monitoring and diligence, prompting internal and external incident investigation and response actions.
At this stage, it remains uncertain if a product vulnerability contributed to the compromise of the application identities. The exact credential-exposure mechanism is under ongoing analysis.
Second, Targeted Wave of Attempts Observed
Following the incident, Huntress identified almost 1,000 Entra tenants with sign-in activity associated with unauthorized access from a specific IP address. Despite successful sign-ins, certain tenants were protected due to the absence of a service principal.
Partners are advised to take several actions, including reviewing Microsoft 365 tenants, verifying application connections, and investigating any suspicious activity.
Huntress recommended implementing various Entra controls to limit damage in case of stolen application credentials.
