ConnectWise Suspends Cloud Services After Microsoft 365 Tenant Compromise: What UK Businesses Should Know

ConnectWise, a widely used platform for managed service providers, suspended seven of its cloud-based application identities over the weekend of 18–19 October 2026 after discovering that unknown threat actors had obtained unauthorised access and used them to compromise Microsoft 365 tenants. The Hacker News reports that the affected services included ConnectWise Cloud Backup and several security and management tools. Security firm Huntress, which first identified the issue, alleged that the compromised application identities were being used to facilitate Microsoft 365 account takeovers. ConnectWise confirmed it had disabled the identities and taken the services offline while its investigation continues.

Why this matters for UK organisations

ConnectWise is used extensively by managed service providers across the UK to deliver remote monitoring, backup, and security services to their clients. When a platform at this level is compromised, the downstream risk is significant: every MSP using the affected services, and every business those MSPs support, could potentially be affected. The use of application identities — rather than stolen user credentials — is a particularly notable technique. Application identities operate within trusted service boundaries, making unusual activity harder to detect through standard user behaviour monitoring. Microsoft 365 account takeovers enabled by this method can provide access to email, documents, Teams communications and a broad range of connected services, creating substantial exposure for affected organisations. For UK businesses that outsource IT management or backup to an MSP, this incident is a reminder that the security posture of your supply chain directly affects your own risk.

What to review

If your organisation uses a managed service provider, the immediate step is to contact them and ask directly whether they use ConnectWise and whether any of their services were affected. Beyond that immediate question, it is worth conducting a broader review of what third-party application identities currently have access to your Microsoft 365 environment. The Microsoft Entra admin centre provides visibility into registered applications and their permissions, and any application that is no longer actively used or cannot be clearly attributed to a known service should be investigated. Ensure that conditional access policies are in place to restrict what connected applications can do, and that audit logging is configured to capture activity from third-party integrations. Organisations should also confirm that their MSP has clear incident notification obligations in their contract, so that future issues of this kind are communicated promptly.

Source: The Hacker News