ConnectWise Cloud Backup Breach 2026: How One Vendor Credential Unlocked Thousands of Microsoft 365 Tenants
In October 2026, ConnectWise disclosed a supply-chain credential compromise in which threat actors exploited a vendor application credential to gain unauthorized access to application identities tied to its Cloud Backup service. First identified on October 14, the attackers used a single compromised vendor credential from IP 144.172.64.128 to perform application sign-ins across thousands of Microsoft 365 tenants. Post-compromise activity included self-granting Global Administrator rights and backdooring additional applications with new secrets for persistence. ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management services, reset credentials, and engaged third-party incident responders. Huntress telemetry across 10,000-plus tenants confirmed the scope. This incident underscores the accelerating threat of supply-chain credential abuse targeting managed service providers. As attackers increasingly pivot through trusted vendor relationships to reach downstream customers at scale, the ConnectWise breach exemplifies why identity hygiene, least-privilege application permissions, and real-time cross-tenant visibility have become non-negotiable security controls for MSP ecosystems in 2026.
Kill Chain
