ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenants.

The IT management software provider said it took the action on October 17, 2026, at 07:00 UTC, adding it has also suspended Cloud Backup service by revoking certificates used for affected application connections across all users.

"Disabling the affected connections prevents new authentication through those connections; it does not reverse changes previously made inside a tenant," it said.

"The affected shared Cloud Backup credentials are no longer valid. Previously issued access tokens may remain usable until they expire or are otherwise invalidated. Any unauthorized credentials, permissions, or other access established through separate identities require additional review and remediation."

ConnectWise also noted that scheduled backups are not running, and access to affected backup archives and restoration capabilities remains unavailable. However, it emphasized that existing archives remain encrypted, isolated, and preserved, and that there is no evidence they were breached or accessed by the attackers.

Out of an abundance of caution, the company said it has temporarily taken SaaS Security and Cloud Management offline while it completes its review of the incident.

Furthermore, the company revealed that it identified the issue on October 14, 2026, through its "advanced cybersecurity monitoring and diligence," prompting it to activate internal and external incident investigation and response actions.

"Since implementing these mitigations, we have not observed successful threat activity in the environments we monitor," it said.

Source link