Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants

Recent coverage details a cybersecurity incident involving ConnectWise, where attackers compromised a credential to gain unauthorized access to Microsoft 365 accounts. According to reports from multiple outlets, exactly 173 Microsoft 365 tenants were compromised in this activity. In response to the breach, ConnectWise took the action of suspending its cloud backup services. Specific reports identify the targeted technology utilizing ConnectWise SkyKick credentials, resulting in unauthorized sign-ins and a subsequent halting of backup operations across the affected environments. Numerous cybersecurity news organizations and technology platforms have actively tracked and reported on the development.

Outlets including The Hacker News, Forkast News, Rescana, Tech-Insider, GBHackers News, LinkedIn posts, Cyber Press, CyberSecurityNews, and BleepingComputer have all covered the supply-chain attack. These reports emphasize various dimensions of the incident, characterizing the event variously as a trust-through-defaults incident, a supply-chain attack, and a credential abuse scenario affecting cloud backup infrastructure. Background information provided in the coverage frames the event primarily around the compromise of administrative or system credentials linked to ConnectWise cloud backup functions. The reliance on default trust structures and integrated vendor credentials created the vector exploited by the hackers to access the numerous downstream Microsoft 365 accounts. Coverage does not yet specify the full identity of the threat actors or provide extended details regarding potential data exfiltration beyond the unauthorized sign-ins and service interruptions.

As the situation develops, readers and affected organizations are directed by ongoing reporting to monitor further updates from ConnectWise and cybersecurity authorities regarding service restoration and remediation steps. Current coverage indicates that cloud backup operations remain suspended while investigations and mitigation efforts continue. Observers will be watching for official statements detailing the precise access vector and any additional indicators of compromise identified during the forensic analysis of the affected tenants.