1 of 1
Story summary
- ConnectWise disabled seven compromised application identities on Oct 17 2026.
- Attackers accessed 173 Microsoft 365 tenants on Oct 13 2026 using a stolen ConnectWise credential.
- They used delegated admin rights to view users and steal mail, files, Teams messages, and directory data.
- ConnectWise revoked the credential, suspended Cloud Backup, and revoked certificates for compromised apps.