ConnectWise Security Incident Triggers App Credential Reset and Service Suspensions

ConnectWise detected unauthorized access to its Cloud Backup application identities in mid-October 2026 and responded by disabling affected apps, revoking credentials, and suspending multiple services. The incident involved a compromised vendor-held API credential that enabled app-only authentication into customer Microsoft 365 and Entra ID tenants.

Timeline and Scope of the ConnectWise Security Incident

Initial sign-ins from the compromised credential occurred between October 15, 06:13 and 08:34 UTC from IP address 144.172.64.128. ConnectWise published its advisory on October 16, disabled seven app identities, and suspended Cloud Backup at 07:00 UTC on October 17. As a precaution, the company also suspended SaaS Security and Cloud Management services. Credential resets completed on October 19, with phased restoration still under preparation as of October 21.

Huntress and other researchers identified unauthorized sign-ins in more than 162 tenants, with later reports citing approximately 173 affected tenants. Activity appeared across nearly 1,000 Entra tenants, resulting in over 300 successful sign-ins. Attackers performed cross-tenant token sweeps using Microsoft Graph. In some cases the apps self-assigned directory roles such as Exchange Administrator or Global Administrator and added long-lived credentials set to expire in 2028. No evidence indicates that backup archives were accessed; the archives remain encrypted and isolated.

The attack followed a supply-chain pattern that exploited vendor app permissions granted in MSP and customer tenants. The client assertion credential resided in ConnectWise’s own tenant and bypassed user multi-factor authentication. Microsoft, Huntress, and Sophos confirmed the details through sign-in and audit logs.

Remediation Steps and MSP Actions

ConnectWise published a technical investigation and remediation guide that instructs partners to review Entra ID Enterprise applications using specific App IDs, including 506e08f9-6e9a-4da4-942b-a099a03644ae for Cloud Backup. MSPs must examine service principal sign-in logs from October 13 onward for suspicious IP addresses and user agents. Additional checks include auditing role assignments, newly added credentials or secrets, granted permissions, and unified audit logs for changes.

ConnectWise directed customers to disable affected apps without deleting them to preserve evidence. Partners should remediate any confirmed issues such as unauthorized secrets or elevated roles before re-enabling the applications. The company completed the credential reset process and stated that services will return through a phased rollout once security validation finishes. No restoration timeline has been confirmed, though the company indicated the process will take several days.

ConnectWise reported no indication that other products were affected or that backup archives were compromised. The firm engaged third-party incident response teams and continues to monitor for further activity. MSPs and customers must continue tenant reviews until formal reconnection instructions are issued.

Service Status and Ongoing Monitoring

As of October 21, Cloud Backup, SaaS Security, and Cloud Management remain suspended. ConnectWise is preparing core infrastructure validation ahead of phased restoration. The company has scheduled webinars to walk partners through the reconnection and reauthorization process once the services return.

Researchers continue to analyze sign-in data for additional affected tenants. MSPs are advised to maintain disabled status for the listed applications until official guidance confirms safe reconnection. Updates from ConnectWise status page and Trust Center will provide further details on root cause analysis and service availability.