This data breach news check has moved: the ConnectWise Cloud Backup exposure story — a stolen credential used to sign into 173 Microsoft 365 tenants with no MFA — now lives on our updated page with the full 7-app-ID IOC set from the October 17 update.
— Ingenious AI security check.
To connectwise-m365-tenant-compromise-check.html — the updated page carries the full October 17 story: 7 app identities disabled, Cloud Backup suspended, certificates revoked, and the complete IOC set. This page redirects you automatically; use the link below if it does not.
A placeholder page that forwards you to the current version of a check — used here because the ConnectWise story grew from the original breach into an October 17 update with new indicators of compromise.
The ConnectWise M365 tenant exposure check now lives at our updated page with the full 7-app-ID IOC set. Redirecting you now…
Attackers used a stolen ConnectWise Cloud Backup credential to sign into 173 Microsoft 365 tenants without MFA. The targeting focused on policy, national-security, trade, and critical-minerals organizations, and a second wave was observed on October 15.
The attackers abused a trusted third-party app identity — ConnectWise's Cloud Backup service principal — so the sign-ins looked legitimate to Microsoft Entra ID and no MFA challenge was triggered.
On October 17, 2026 ConnectWise disabled 7 app identities, suspended the Cloud Backup service, and revoked certificates — while warning that previously issued tokens may remain valid, so tenants must hunt for them.
Ingenious AI publishes 21 live security platforms, and 100% of them run on permanent getingeniousai.com domains.