# Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants

> **Open Intelligence Dossier** · First detected: 2026-10-17 17:20 UTC · Category: Technology

## Executive Summary
Hackers exploit a compromised ConnectWise credential to breach 173 Microsoft 365 tenants, halting cloud backups.

## Intelligence Brief
Recent coverage details a cybersecurity incident involving ConnectWise, where attackers compromised a credential to gain unauthorized access to Microsoft 365 accounts. According to reports from multiple outlets, exactly 173 Microsoft 365 tenants were compromised in this activity. In response to the breach, ConnectWise took the action of suspending its cloud backup services. Specific reports identify the targeted technology utilizing ConnectWise SkyKick credentials, resulting in unauthorized sign-ins and a subsequent halting of backup operations across the affected environments. Numerous cybersecurity news organizations and technology platforms have actively tracked and reported on the development.


Outlets including The Hacker News, Forkast News, Rescana, Tech-Insider, GBHackers News, LinkedIn posts, Cyber Press, CyberSecurityNews, and BleepingComputer have all covered the supply-chain attack. These reports emphasize various dimensions of the incident, characterizing the event variously as a trust-through-defaults incident, a supply-chain attack, and a credential abuse scenario affecting cloud backup infrastructure. Background information provided in the coverage frames the event primarily around the compromise of administrative or system credentials linked to ConnectWise cloud backup functions. The reliance on default trust structures and integrated vendor credentials created the vector exploited by the hackers to access the numerous downstream Microsoft 365 accounts. Coverage does not yet specify the full identity of the threat actors or provide extended details regarding potential data exfiltration beyond the unauthorized sign-ins and service interruptions.


As the situation develops, readers and affected organizations are directed by ongoing reporting to monitor further updates from ConnectWise and cybersecurity authorities regarding service restoration and remediation steps. Current coverage indicates that cloud backup operations remain suspended while investigations and mitigation efforts continue. Observers will be watching for official statements detailing the precise access vector and any additional indicators of compromise identified during the forensic analysis of the affected tenants.

## Multi-Source Evidence Table
| Source Outlet | Headline | Verification URL |
|---|---|---|
| The Hacker News | ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants | [Source Link](https://news.google.com/rss/articles/CBMihAFBVV95cUxPamJycFRPeUdfNnlxcWtWXzB2RXZVNFVfTFRCLUs3ZWJxdVplX3J1LUJwbEpZT3dDWHA4bWljVEVqbTJtV3RfNjhjem1PTTBzRXprVmJYbEttTGdvVXFfRExZUTFiYTRmMEw3dnJHaElTeUsxcjR5bl9XWXNxRkFoSk9rcWw?oc=5) |
| Forkast News | ConnectWise Cloud Backup Credential Abuse: 173 M365 Tenants Compromised in Trust-Through-Defaults Incident | [Source Link](https://news.google.com/rss/articles/CBMixgFBVV95cUxNZ3hURVpLd0dSWUM0RjZ2LUU4Z21RZkxObzkyOGstNnRWWWJuRmRSTUVBcXFGZHZ3a2VmaGRmMEM1RmJPTjlGS2Yxc2UwS2NBNE9GM3ctaXBFRUdyLXFDa1YyQkRndmJNUkNhR1V2WFlWc0MzbGozbnhiZ3VaSkNGWXg0R19ZV1RJNElZRUxFemhQV1c4WmQxMENxdE1nXzdFM3VDSXdOelhpTWYyaVU5SWFtUXU3WXl1UGZmODVTRnRUSHlza0E?oc=5) |
| Rescana | ConnectWise Credential Compromise Enables Unauthorized Access to 173 Microsoft 365 Tenants: Cybersecurity Incident Analysis | [Source Link](https://news.google.com/rss/articles/CBMi4wFBVV95cUxPUzdBbXBVTXJjenZWSFhzR0J6b0tZbk1KUXFBN3hVdVQwNWZ5TkVQbm0zeE4wdFBiaXRPbmhwbU1YV2hsUUhxWDA1dHIxRHVyRXRFd0NtbzBUMkstYlB5RTRMbGFFVUxCUzkzZWpFMk8wSk8tRWVUMlhsTVM5WWdKamtoS1Ftb0hkS25Fd2l0Nk5Td1RPOEFuV2xZSXo5N09nMjRwZlVGajk4S1Z4ZFZFcTA4Zmg4OF9UbWFsM1FnTkFvdFN2RkVjT2t5bXM1TGUxRklzbk1KbGxOR2ltZmdxU0hZSQ?oc=5) |
| https://tech-insider.org/ | ConnectWise Cloud Backup Breach Hits 173 Tenants [2026] | [Source Link](https://news.google.com/rss/articles/CBMif0FVX3lxTE90WHktTm9nVmJSNmVyOWpKaXdCN0E5X3pZNkl2S0pOaDQyWm1XMjRfa2Z1eEp0elZYQzV5aWJJb2ZFWVVTVnhDTFZxbmg5elN6WUh0VGFIdGc0TExuR2NQSnBUYlprUEcxNC1YRC1sVFF1SVUyUjZWNmFucEg3N3M?oc=5) |
| GBHackers News | Hackers Use ConnectWise SkyKick Credentials to Access Microsoft 365, Halting Cloud Backups | [Source Link](https://news.google.com/rss/articles/CBMidEFVX3lxTE15M0VmQ1pGZ3hVQWplS2F2RW13eTVrNFdhVDJrYmtUUVBZYWVMTnJnWjBpYnNDLW53Vm5EVHdUTHJqWGlqTnUxbFBBNElUR1B2dzdZQ1dPN2M4a2ppVHV3WTEyOTgyU25KNWxhMTFYMFh2ZmxT0gF6QVVfeXFMTjFNaGpUWFJ3ZHFjMExxMFdDbVhVZG5nakZZaTBJcXpQb29uRWdnTGNJTmpOYUwyT29yOVAxWkxId0Q5SGJZdXJ5UmxNVFpSSklJeGtkalBKZ2J0aklwNENSRVpZbzhwUjF0Yy1QelVYeHh3Z1BEQzZLOVE?oc=5) |
| LinkedIn | WARNING: ConnectWise Supply-Chain Attack Exposes Microsoft 365 Tenants | [Source Link](https://news.google.com/rss/articles/CBMijAFBVV95cUxPT3BaSGs5Y0R6NjR0RzRITVc2TGo1Yjd6aVFIamM0LWxzeEM2S1lhbEkxOWc0eGh6ZGY5XzNpQXNmcmoyWmtuQlRjN1NwQVJ5UER4TFh2ZEF1WXNWT0phNlJRUFJoY1c5Z3RBcHE0NXNMMlpTVndLeHBiYllHVUpDOUVmNzI0eEdBQzZZRg?oc=5) |
| Cyber Press | ConnectWise SkyKick Credentials Abused in Microsoft 365 Attacks, Backup Services Shut Down | [Source Link](https://news.google.com/rss/articles/CBMifEFVX3lxTFBSbnhaQnNjNkRvRWdWbzluU1ItREROWWhBaWt4Y1ZyaVpQYTFHVjV5T3ljYklwVndYVjdVZ3o3dW4xVnV2Ym95QV9nVWpXNGVuYVM2WmpfQWxSSktmUWtzcVhtN085eExLb2hHd2picDRIMlJKQkxZSEdtUGPSAXxBVV95cUxQUm54WkJzYzZEb0VnVm85blNSLURETlloQWlreGNWcmlaUGExR1Y1eU95Y2JJcFZ3WFY3VWd6N3VuMVZ1dmJveUFfZ1VqVzRlbmFTNlpqX0FsUkpLZlFrc3FYbTdPOXhMS29oR3dqYnA0SDJSSkJMWUhHbVBj?oc=5) |
| CyberSecurityNews | Hackers used Compromised ConnectWise Backup Credentials to Hack 173 Microsoft 365 Accounts | [Source Link](https://news.google.com/rss/articles/CBMigwFBVV95cUxOdjBNbGZBM3lMQXRDeTZOcFc4cVFZenVRZUpiWUpMSW1jaEhZV2s5emRvbm9GdGNYbjIxOHRFMXhDbTZzVjBLaGlIN0hpS0RFSURDdkU3UENDblhqN0JWY0FXc1BmblNjQlJBVXVIZjMxS3lLWVhWQ2hxc0oxNEw4TE9Rb9IBiAFBVV95cUxOd3JZcTlEMjF6THlwWU55M2RWSGxObktWY2RlRVVLSFJHc0pBR25mVUVjWVRxeDNhOHF0aUkzTFpzaVFKUlZiNzB5c0huZHVTMkVQQ3FPa3hTVmMxYUlIZEhTdWNaNkVicm9WNWVwbTlydHZsUGFLd2M1SVVHS3VCeWRnMlNuZnVs?oc=5) |
| BleepingComputer | Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack | [Source Link](https://news.google.com/rss/articles/CBMivAFBVV95cUxNclltSEJ0UTh3UzMya2ZUNlJnMVRkeTBsX2d5bEdxeDJKUlhOZ1lBVi1vX21WYWkzdmZ0VVhRSVY0THlYOXcwR2ZfY1NvSzJoNENTS2ljWEpFRXVCYnpDR3NjTXd5ZE5QMFprV1Y4R3kxV2JrdGhpRFh0QzZXcE56UE82M3VJSDJIVGJrNGlRdmpBM2duYXRzOTlub0R4WVY5WmdSWjZQWURHLTJhSXRnTUt5Q3N2dTlObm9yTNIBwgFBVV95cUxQb010TkNjTHNkazM5ZXkyT1ZIZXVTNVF5VUQwNkowTEVLWVNBbWxXcjM2TXRvUUFlR2VqLVZsM3lXdHJiZTkwT2dJZjIzaWUySWl4NHRpNXdLczlnckIwX0NPamhQUzV2QkhmdHNnWXpaZ1hfVTFzY3ctUC1xbmt4QXV0bzZTV3lsSTFDaWxsN1VaQnlYSDF) |
| The Hacker News | Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants | [Source Link](https://news.google.com/rss/articles/CBMif0FVX3lxTE9LLVo4bDAtYTNoMmpoeFIwdFpheVNIQVJMaXZqOUtaZXZ4TjE4M2E3T0Z4SlA0aVJtNGh3N2dBSXg2SWZiQ0EtcVRKNnhrU1E3RVN5ejJ1V0h4Y2U1SG5nMmtGV2xWckV6NkJWaVJ2VEZDWGVVVTdRLUI1YzgxUUU?oc=5) |

---
*Canonical Source: https://pulse.byoaiapps.com/trend/2026-10-17/hackers-use-compromised-connectwise-credential-to-sign-in-to-173-microsoft-365*