Credential Compromise Turns a Backup Tool Into a Global Administrator Control Plane

Hackers used a single stolen ConnectWise Cloud Backup credential to sign into 173 Microsoft 365 tenants on October 15, 2026. An automated script logged into the affected partners and customers sequentially, indicating the attackers had a targeted list of victims. In one tenant, the ConnectWise Cloud Management app assigned itself the Global Administrator role and added new client secrets to other trusted apps, effectively completing the takeover. ConnectWise has closed Cloud Backup application access until further notice. The company found no evidence that partner backup data itself has been compromised.

How the Takeover Works

A single script exploited a vendor API secret to gain initial access. Once inside a tenant, the attacker moved through the victim's resources using Microsoft Graph tokens with app-only permissions. This level of access allowed them to read mail, modify files, and read directory data. With the Global Administrator role, the attacker could redeploy the compromised app to other tenants within their target list. The scale of the breach 173 tenants demonstrated how networked service credentials can cascade into industry-wide risks.

Corrective Action

ConnectWise has revoked Cloud Backup application access to mitigate the risk. The company asserts that partner backup data was not exposed during the incident. Access restrictions provide a defensive layer, though the breach demonstrates the security impact of compromised credentials in multi-tenant vendor ecosystems. The automated nature of the attack suggests organizations should audit which service accounts are assigned Global Administrator roles and enforce the principle of least privilege across all connected applications.