Enterprise IT News

ConnectWise Breach Hits 173 Tenants

By Nattapong Sukkasem · Published 2026-10-19 · Updated 2026-10-21.

Most incidents give defenders something to do: a patch to stage, a host to isolate, a password to reset. This one gave them a revocation — and then a wait. When ConnectWise disabled the compromised identities on 17 October, tokens already issued stayed valid until they expired on their own, a window the vendors involved put at up to ninety minutes. That gap between "we cut it off" and "it stopped working" is the most instructive thing in this week's enterprise IT news, because it is the same gap that governs DNS records, certificate revocation and every other distributed trust decision an IT team makes.

What is known so far

An attack that used no exploit at all

The mechanics are unusually plain, which is what makes them worth studying. A backup product for Microsoft 365 must read mail, files, sites and chats on behalf of the customer. It does that as a registered application with a client secret, consented once by each tenant and then left alone for years — one credential, valid everywhere the application is installed.

Whoever obtained ConnectWise's secret needed nothing else. They authenticated directly to Microsoft Graph as the application, from their own tooling, and received tokens carrying its existing permissions. Because no user signed in, multi-factor authentication was never consulted. Todyl, which analysed nine affected tenants, found sign-in activity but no account creation, password changes or new persistence through the backup app — the access was already sufficient.

Patch-centric programmes measure themselves against the zero-day vulnerability count, and nothing in that metric would have moved this week. Microsoft, which classified the activity as an active supply-chain attack, assessed that the attacker simply abused permissions the application legitimately held, including directory read and write. A DDoS attack sets off every alarm an organisation owns within seconds. This set off almost none, because each request it made was one the service was expected to make, at an hour it was expected to make it.

Revocation has a TTL, and you set it months ago

This is the part that should change how teams write runbooks. Disabling an application in Entra ID stops it obtaining new tokens. It does not invalidate the tokens it already has. Revoking user sessions, the reflex action in most identity playbooks, does nothing at all to application access, because no user session exists. For a window measured in tens of minutes, the attacker kept working with credentials that had, on paper, already been withdrawn.

Anyone who has moved a production domain will recognise the shape of that problem immediately. A DNS record change is not a command; it is a new answer that propagates only as fast as cached copies of the old answer expire. If the record carried a 3,600-second TTL, the organisation accepted a one-hour rollback window long before it needed one. The same arithmetic governs certificate revocation, where cached validation responses keep a dead certificate alive, and it governs OAuth, where the access-token lifetime is the real duration of a compromise.

The operational lesson is that all three numbers are configuration, not fate. They are chosen in quiet conditions, usually by somebody optimising for performance rather than for the worst day. Teams that lower a record's TTL a week before a migration already understand this; the same discipline belongs on token lifetimes, conditional-access policy and the validity of every secret a third party holds. Our DNS propagation checker exists precisely because the delay between a change and its effect is hard to intuit, and a DNS and DNSSEC lookup will show you the TTL a resolver is actually honouring rather than the one you believe you published.

The delegation nobody inventories

The broader exposure is that managed service providers hold standing, cross-tenant authority over customers who have no practical way to audit it. A consented application is not a connection a customer can watch; it is a trust relationship recorded as a GUID in a blade most administrators open once, on the day they approve it. Hundreds of organisations learned on 17 October that they had granted mailbox-level access to a supplier's supplier.

This is the uncomfortable centre of modern cloud security. Perimeter controls, endpoint agents and egress filtering all sit on infrastructure the customer operates. The compromise here happened entirely between two clouds, over an API, using a credential held by neither the attacker's victim nor the victim's own staff. Nothing crossed the customer's network. It is a reminder that the server infrastructure an organisation depends on now extends well past anything it can instrument, and that the only durable control over delegated access is knowing precisely what has been delegated.

Seven checks worth running this week

1. Disable the implicated applications until ConnectWise confirms every credential has been rotated, and treat the shutdown window as the start of your clock, not the end of your exposure.
2. Audit credentials added since 13 October. Review secrets and certificates across every registered application and remove anything you cannot account for.
3. Check for self-assigned roles. Look in audit logs for ConnectWise or SkyKick identities adding themselves to Exchange Administrator or Global Administrator.
4. Enable Microsoft Graph activity logs. Huntress notes that some reads leave no other trace, so without this telemetry the question of what was taken may stay unanswerable.
5. Write token lifetimes into the runbook. Record, per integration, how long a revoked credential keeps working, alongside the TTLs on your critical DNS records.
6. Inventory consented applications across every tenant you administer, with owners and renewal dates, as a standing IT security control rather than an incident task.
7. Review egress expectations. Legitimate backup traffic arrives from the vendor's cloud ranges; authentication from anywhere else is worth an alert on its own.

This follows the GhostAction credential theft we covered earlier this month, where stolen secrets left a repository in sixteen minutes. The pattern is consistent: the credential, not the exploit, is the unit of compromise.

Industry impact

The significance of this enterprise IT news is not that one vendor lost a secret. Secrets leak constantly. It is that a single secret held by a mid-sized software company carried standing, pre-approved authority into the mailboxes of hundreds of unrelated businesses, and that withdrawing it took effect on a schedule nobody involved had thought to write down.

Managed services made that concentration rational: one provider, one integration, one consent screen, thousands of tenants. The economics are excellent and the blast radius is enormous. Regulators and insurers have begun asking about fourth-party risk for exactly this reason, and incidents like this supply the arithmetic.

For practitioners the takeaway is narrower and more useful. Know your expiry times. Know them for your access tokens, your certificates and your DNS records, and know them before the day you need to act on them, because in every one of those systems the speed of a withdrawal is fixed by a value somebody chose when nothing was going wrong. That is the quietly expensive detail buried in this week's enterprise IT news, and it is the one that transfers to every other integration in the estate.

Sources

• The Hacker News — Hackers use compromised ConnectWise credential to sign in to 173 Microsoft 365 tenants
• BleepingComputer — Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
• The Hacker News — ConnectWise suspends Cloud Backup after attackers compromise Microsoft 365 tenants

Related articles

• FortiMail Zero-Day Exploited, No Patch
• PeopleSoft WAF Bypass Exploited
• Chrome V8 Zero-Day CVE-2026-85046 Exploited: Update Now

DNS angle

Review resolver logs for the systems discussed above and compare unexpected names with your approved services. A successful lookup does not establish that a destination is safe. Use the DNS lookup tool to inspect current answers, then compare them with your own resolver and incident records.

Source: BleepingComputer — Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack (2026-10-17).