ConnectWise Cloud Backup and AI accelerated identity abuse
Report edition: 22 October 2026 · PDF page 15
Research reviewed 22 October 2026 · Evidence and editorial planning guidance are distinguished below.
- Operational priority
- Critical
- Evidence
- Vendor-confirmed identity incident
Phased restoration; vendor update 22 October 13:00 UTC
Priority is conditional on actual exposure. An asterisk highlights especially conditional exposure; these are editorial judgments, not CVSS scores.
Explore this topic in depth
Ten detailed reports: four shared analyses and six audience perspectives. Research reviewed 22 October 2026; the original PDF account remains below as a dated snapshot.
Research update and qualifications
Microsoft describes abuse of trusted application credentials and app-only access in the ConnectWise-related campaign. That access can operate without an interactive user login. Investigation therefore needs application identity and data-access evidence, alongside the vendor’s service-specific recovery guidance.
Microsoft research on the ConnectWise compromise · Vendor advisory and Microsoft threat research revisited.
An application’s presence or a sign-in record is not by itself proof of data exfiltration. Do not generalize this event to all Microsoft tenants or declare a tenant clear from supplier uptime.
The original PDF snapshot
What the report establishes
ConnectWise confirms unauthorized Cloud Backup application-credential access and continued phased restoration. It reports no indication that preserved encrypted backup archives were compromised. Microsoft attributes the supply-chain activity to Storm-0940 and reports ARTEX-assisted downstream operations, including credential and privilege changes. Attribution remains Microsoft's assessment.
Impact and potential reach
Microsoft reports attempted sign-ins to more than 2,250 tenants; this is not a count of breached tenants or stolen datasets. Application presence or successful authentication alone does not prove data theft. Live Microsoft 365 environments still need investigation.
Required actions
MSP and identity owners: keep affected connections disabled until service-specific restoration instructions apply. Preserve evidence rather than deleting enterprise applications first. Review current and historical integrations by application ID, service-principal sign-ins, Graph activity, credential additions, consent and role changes. Remove confirmed persistence and validate independent recovery access.
Six perspectives on this topic
For the business manager
Coordinate the business effects of temporarily restricted backup or administration access. Teams may continue working while their recovery coverage changes. Record that condition explicitly and avoid making new commitments that assume normal recovery capability.
Read the business manager report for priorities, evidence and a decision checkpoint.
For the business owner
Ask who owns the permissions granted to external applications, not only who pays for the subscription. A backup supplier may hold broad access to commercially sensitive information. Require a tenant-specific assessment and a demonstrated recovery path before accepting restoration.
Read the business owner report for priorities, evidence and a decision checkpoint.
For the technical manager
Lead an application-identity investigation alongside ordinary user identity response. Preserve configurations before destructive cleanup so owners, grants and credential changes remain attributable. Coordinate with the vendor while retaining responsibility for the tenant’s evidence and decisions.
Read the technical manager report for priorities, evidence and a decision checkpoint.
For the software engineer
Work with identity responders to trace authorization through application credentials and resource permissions. A normal user login test does not validate app-only containment. Preserve evidence and avoid deleting objects simply to make the administration screen look clean.
Read the software engineer report for priorities, evidence and a decision checkpoint.
For the customer service
Use precise language about confirmed information access and ongoing investigation. Do not infer that customer data was exported merely because an application was installed. Conversely, avoid using normal login availability as reassurance about application permissions.
Read the customer service report for priorities, evidence and a decision checkpoint.
For the customer
Ask the business for information relevant to your records rather than trying to interpret its cloud administration logs. A supplier incident can require investigation without proving that every customer was affected. Verify any unexpected communication through your usual contact.
Read the customer report for priorities, evidence and a decision checkpoint.
In this section
- ConnectWise: Evidence and scopeAn application’s presence or a sign-in record is not by itself proof of data exfiltration. Do not generalize this event to all Microsoft tenants or declare a tenant clear from supplier uptime.
- ConnectWise: Business impact and costsA trusted backup integration can expose business information without interrupting ordinary user login. Disabling it may also reduce recovery coverage, so the business needs a temporary continuity decision while identity scope is investigated.
- ConnectWise: Technical exposure and controlsMap enterprise applications, service principals, owners, credentials, consent grants and roles. Relate app-only activity to the mailboxes, files and other resources that the granted permissions could reach.
- ConnectWise: Response and recoveryRe-enable the integration only after identity ownership, required permissions, account-specific findings and the independent recovery plan have been approved.
- ConnectWise: Business manager reportWhat business work is being created while our normal backup integration is restricted?
- ConnectWise: Business owner reportCan the business recover if its backup identity is part of the incident?
- ConnectWise: Technical manager reportWhich permissions remain usable after every human user has changed their password?
- ConnectWise: Software engineer reportCan this application access a resource that its business purpose does not require?
- ConnectWise: Customer service reportDoes our answer distinguish possible access from verified activity involving this customer?
- ConnectWise: Customer reportWhat does the business know about my information, and what remains under investigation?