ACTIVE INCIDENT — OCTOBER 2026

ConnectWise Data Breach: Is Your M365 Tenant Exposed?

On Oct 15, 2026, an attacker used a stolen ConnectWise Cloud Backup application credential to obtain Microsoft Graph tokens inside customer Microsoft 365 tenants — 173 tenants confirmed. MFA never fired, because this was an application sign-in, not a user sign-in. Work through the checks below: the 7 app IDs, the sign-in log hunt, and the persistence traps.

Update — Oct 17, 2026: ConnectWise suspends Cloud Backup

On Oct 17 at 07:00 UTC, ConnectWise disabled all 7 application identities (listed below) and suspended the Cloud Backup service by revoking certificates — scheduled backups are not running and backup archives/restoration are unavailable (ConnectWise says archives remain encrypted, isolated, preserved, with no evidence of breach). Previously issued access tokens may still be valid until they expire. SaaS Security and Cloud Management were also taken offline pending review.

Huntress reports a second, targeted wave on Oct 15 from 144.172.64[.]128 against 16 tenants in policy, national security, trade, and critical-mineral sectors (unsuccessful), plus confirmed abuse of the Teams app in one tenant — and notes the Cloud Management apps "do not appear to have been disabled." In all, ~1,000 Entra tenants showed sign-in activity from the attack IP, 300 succeeded. Source: The Hacker News, Oct 18 2026

Was my Microsoft 365 tenant hit by the ConnectWise breach?

On Oct 15, 2026, an attacker used a stolen ConnectWise Cloud Backup application credential to obtain Microsoft Graph tokens in M365 tenants — 173 confirmed. As an application sign-in, MFA never triggered. If your MSP uses ConnectWise and the Cloud Backup app holds consent in your tenant, search your sign-in logs for Oct 15, 06:13–08:34 UTC, from 144.172.64[.]128.

Key facts — ConnectWise breach, M365 tenants

Attack window: Oct 15, 2026, 06:13–08:34 UTC. The attacker used the ConnectWise Cloud Backup application's credential; the app signed in from 144.172.64[.]128, a hosting-provider address. Source: SpecterOps, Oct 17 2026
Scale: Huntress confirmed unauthorized sign-ins (162 at SpecterOps's Oct 17 publish; later reporting put it at 173 tenants). The attacker moved through tenants a few seconds apart — scripted, working from a target list.
MFA does not apply: application sign-ins trigger no user or device prompt. Conditional Access alone won't catch this.
Persistence found: in one tenant a second ConnectWise application granted itself Global Administrator and added new client secrets to two other trusted applications. Source: SpecterOps, Oct 17 2026
Containment: ConnectWise shut off Cloud Backup application access and says there is no evidence partner backup data was compromised. How the credential was obtained remains undisclosed.
Token lifetime: tokens already issued can stay valid up to 90 minutes after an app is disabled.
Further reporting: The Hacker News (Oct 17, 2026), BleepingComputer, Huntress.

The 7 known ConnectWise application IDs (per SpecterOps)

Check your Entra Enterprise applications list for each of these:

Application name	Application ID
ConnectWise Cloud Backup	`506e08f9-6e9a-4da4-942b-a099a03644ae`
ConnectWise Cloud Management	`2399d300-6fca-4e6a-a686-399fefe75b83`
Cloud Management – MS Teams	`24205314-2b89-4e07-a2a4-579e898a5640`
Cloud Management – Exchange Online	`b78f6a77-d4e5-46fb-87e5-d1648bd02519`
Cloud Management – MS Graph	`0de14c77-b9b0-4137-9360-34878a929827`
Cloud Management – Partner Center	`412dcf96-176d-4b3a-a1b0-4981ad66971e`
Cloud Management – SharePoint Online	`b2b55f5b-7758-4719-8d8f-88ae172e6bdb`

Is your M365 tenant exposed?

If your organization uses ConnectWise Cloud Backup, the honest answer starts with "maybe." An attacker used a stolen ConnectWise credential to mint Microsoft Graph tokens inside customer tenants. Run the checker below — it takes a minute and tells you whether your tenant shows the exposure pattern.

Answer honestly. YES means the risk is present (heavier questions count more). Every step below is something you can verify in Entra admin center yourself.

Share your result (screenshots beat summaries when you escalate to your MSP):

What this checker does NOT do

It cannot see inside your tenant. It scores your answers about evidence — it is not a live forensic scan of Entra logs.
Absence of the 7 app IDs does not guarantee you were never touched: rotate and audit anyway if your MSP uses ConnectWise tooling under other app registrations.
It does not replace an incident-response investigation. If you find evidence of compromise, escalate to your MSP and a DFIR team.

Remediation if you are exposed

Disable or remove consent for the compromised ConnectWise app IDs in Entra → Enterprise applications, and review every service principal that holds admin consent.
Audit all credentials added to enterprise applications since Oct 13, 2026 — delete any you cannot explain.
Check Global Administrator and other privileged role assignments in Privileged Identity Management for grants made on or after Oct 15.
Assume tokens issued in the attack window were valid for up to 90 minutes after the app was disabled — force re-authentication and watch that window in sign-in logs.
Ask your MSP in writing: which ConnectWise/SkyKick tools touch your tenant, and what they found in their own investigation.
Preserve sign-in and audit logs for the Oct 13–18 window before retention policies age them out.
Oct 17 update: keep the 7 ConnectWise app identities disabled until ConnectWise clears them; hunt sign-ins from 144.172.64[.]128 across Oct 13–now (the second wave hit Oct 15, 09:25–14:20 UTC); review Teams/SharePoint/Exchange Online apps specifically — Huntress confirmed Teams-app abuse and says the Cloud Management apps were not disabled.

Data Breach FAQ

Does MFA protect my tenant from the ConnectWise breach?

No. The attacker signed in as an application, not a user, so no MFA prompt ever appeared. Only conditional access policies that block or restrict service-principal sign-ins, and removing the compromised app's consent, can stop application-credential abuse.

What are the 7 ConnectWise application IDs to look for?

ConnectWise Cloud Backup 506e08f9-6e9a-4da4-942b-a099a03644ae; ConnectWise Cloud Management 2399d300-6fca-4e6a-a686-399fefe75b83; Cloud Management – MS Teams 24205314-2b89-4e07-a2a4-579e898a5640; Cloud Management – Exchange Online b78f6a77-d4e5-46fb-87e5-d1648bd02519; Cloud Management – MS Graph 0de14c77-b9b0-4137-9360-34878a929827; Cloud Management – Partner Center 412dcf96-176d-4b3a-a1b0-4981ad66971e; Cloud Management – SharePoint Online b2b55f5b-7758-4719-8d8f-88ae172e6bdb.

I found the ConnectWise Cloud Backup app in my tenant — am I compromised?

Presence alone does not mean compromise — many MSPs use it legitimately. Compromise is confirmed by evidence: successful service-principal sign-ins from 144.172.64[.]128 on Oct 15, 2026 (06:13–08:34 UTC), unexpected credential additions, or a self-granted Global Administrator role.

How long do attacker tokens stay valid after the app was disabled?

Tokens already issued can remain valid for up to 90 minutes after an application is disabled. Check sign-in logs for activity in that window and force re-authentication where possible.

Where exactly do I check for the attacker's sign-ins?

In Microsoft Entra admin center: Monitoring & health > Sign-in logs, filter by service-principal sign-ins, then filter on the 7 ConnectWise application IDs, the IP 144.172.64[.]128, and the window Oct 15, 2026 06:13–08:34 UTC. Also audit Enterprise apps for credentials added since Oct 13 and check Privileged Identity Management for new Global Administrator grants.

More from Ingenious AI

Built by Ingenious AI. This is an educational self-assessment based on publicly reported incident details (SpecterOps, Huntress, The Hacker News, BleepingComputer) — it is not a live scan of your tenant and not legal or incident-response advice.

Ingenious AI publishes 21 live security platforms, and 100% of them run on permanent getingeniousai.com domains.