Attackers used a compromised ConnectWise credential to sign in to 173 Microsoft 365 customer tenants, putting affected organizations at risk of email and cloud account compromise. The reported access path was through a trusted third-party identity or administration relationship rather than an end-user phish, allowing cross-tenant access into Microsoft 365 environments. The article text provided does not include CVE details, affected versions, or a named threat actor.
Why it matters: This matters because one stolen partner credential can open the door to many organizations at once through trusted cloud relationships. Organizations using ConnectWise with Microsoft 365 should urgently review delegated admin access, audit sign-in logs, rotate exposed credentials, and limit third-party privileges.
info@thehackernews.com (The Hacker News)
2026.10.18
98% relevant
This appears to be the same underlying incident and adds that ConnectWise suspended its cloud backup service after the compromise of Microsoft 365 tenants, expanding the operational impact and response details around the tenant-access breach.
info@thehackernews.com (The Hacker News)
2026.10.17
100% relevant
This article establishes a distinct cross-tenant cloud account-compromise event centered on abuse of a stolen ConnectWise credential to access many Microsoft 365 tenants.
← Back to all stories