WARNING: ConnectWise Supply-Chain Attack Exposes Microsoft 365 Tenants
ConnectWise's cloud services were compromised, exposing Microsoft 365 customers to unauthorized access. The attack involved credentials linked to ConnectWise Cloud Backup, affecting 173 partner and customer tenants. ConnectWise confirmed unauthorized access and disabled application access while investigating. Researchers also found abuse of other ConnectWise applications, advising customers to disable affected apps and review credentials.
How this was made
The 30-second read
Why it matters
The incident underscores the risk of third‑party application identities in multi‑tenant environments and may prompt tighter security reviews across cloud services.
Market read
While ConnectWise is private, the breach could affect investor sentiment toward cloud‑service providers and prompt heightened security spending.
What to watch
Microsoft's own security controls and rapid remediation could limit downstream damage to its tenants.
Background
ConnectWise, a private cloud‑backup vendor, suffered a supply‑chain attack that exposed Microsoft 365 tenants via compromised application credentials.
Market effects
Highlights supply‑chain security risks for SaaS and cloud‑backup providers.
Potential short‑term pressure on US tech stocks reliant on third‑party backup services.
Raises broader concerns about multi‑tenant cloud application vulnerabilities worldwide.
Counterpoint
The breach may be contained with limited financial fallout, keeping stock impact muted.
Key entities
- companyConnectWise
Private provider of cloud backup services whose credentials were compromised.
- companyMicrosoft
Owner of the 365 platform whose tenant environments were accessed.
- companyHuntress
Security firm that reported additional abuse of ConnectWise management apps.
- companyTodyl
Security firm that independently identified unauthorized sign‑ins in affected tenants.


