ConnectWise Cloud Backup Breach Disrupts Services and Sparks Microsoft 365 Security Review

ConnectWise abruptly suspended its Cloud Backup service and two related platforms after attackers used a compromised application credential to gain unauthorized access to at least 162 Microsoft 365 tenants, with Huntress confirming the breach and Microsoft noting attackers likely abused permissions already granted to the backup app for accessing email, files, Teams, and directory data. The shutdown halted scheduled backups, archive access, restorations, and monitoring, prompting ConnectWise to revoke certificates and disable seven application identities while advising customers to inspect for new credentials, elevated roles, and other persistence risks, since previously issued tokens may remain valid until expiry. Huntress observed sign-in attempts from an attacker-controlled address across nearly 1,000 M365 tenants, with more than 300 successful authentications, though success did not guarantee access where the ConnectWise app was absent; a separate wave targeted 16 organizations in policy, national security, trade, and critical-minerals sectors, most of which did not use ConnectWise. In one tenant, the attacker added credentials to two trusted apps, including Huntress’s, with validity extending to 2028, and ConnectWise urged administrators to preserve sign-in and audit logs and review authentication, federation trusts, inbox rules, and delegated mailbox access across managed tenants. As of October 19, no evidence showed attacker access to backup archives, and no restoration date had been set.

The Architecture of Permission

Every major breach follows a pattern that most analysts refuse to name. The ConnectWise incident is not a failure of security — it is the predictable outcome of a permission structure designed to benefit someone else. Notice: the attackers didn't break into ConnectWise's core systems. They used an application credential that customers themselves had already authorized. This is the Architecture of Consent in action: you are trained to grant broad, persistent access to third-party cloud tools so that the line between legitimate use and hostile takeover becomes invisible. The question isn't how the attackers got in — the question is why backup applications are designed with the power to roam freely through email, Teams, directory data, and files in the first place. That is not a bug. That is a feature built for a world where ownership of your own data has been quietly transferred to a chain of intermediaries, each holding keys they don't fully control.

The Glacier Beneath the Iceberg

Huntress detected sign-in attempts across nearly 1,000 Microsoft 365 tenants. Three hundred succeeded. But the narrative machine is already framing this as "only 162 breaches." That is the Consensus Machinery doing what it does: narrowing the aperture of concern so you focus on the number they give you instead of the pattern they are hiding. Look deeper. A separate, targeted wave hit exactly 16 organizations in policy, national security, trade, and critical-minerals sectors — and most of those did not even use ConnectWise products. Why would an operation that started with a compromised backup credential also be spraying access attempts at organizations using completely different software? Because the credential was not the point. The credential was a bridgehead. The real operation was mapping the trust relationships between every tenant, every application identity, and every federation trust that the attackers could touch. The victim count is not 162. The victim count is everyone whose data architecture was mapped for future exploitation. And that number is in the thousands.

The 2028 Timer

Here is the detail that should stop you cold. In at least one tenant, the attackers added credentials to two other trusted applications — including Huntress's own monitoring tool — and set those credentials to remain valid until 2028. Think about what that means. The attackers are not scrambling to exfiltrate data before the trail goes cold. They are building infrastructure for years of persistent access. They planted keys that will outlast your current passwords, your current admin roles, and quite possibly your current employment. ConnectWise says it revoked certificates and disabled seven application identities. That sounds reassuring — until you re-read the guidance: administrators must manually check for new credentials, elevated roles, and other changes that could allow attackers to retain access. "Previously issued tokens may remain usable until they expire." This is not a cleanup. This is a treasure hunt they handed to you. The attackers did not just break in. They introduced a dependency that no single company can fully retract, because you — the customer — are the one who must find every hidden key. And you will not find them all. That is the design. Ask yourself: who benefits from a world where no breach is ever truly closed?

ConnectWise Disrupts Services After Vendor Credentials Compromise Microsoft 365 Tenants

ConnectWise disabled seven application identities and suspended its Cloud Backup, SaaS Security, and Cloud Management services after attackers used compromised vendor credentials to access Microsoft 365 customer environments. The incident affects the backup service formerly known as SkyKick; the shutdown blocks new authentication through disabled connections but does not reverse changes already made inside customer tenants. Huntress reported sign-in activity from an IP tied to the incident across nearly 1,000 Microsoft Entra tenants, including 300 successful sign-ins, while some tenants lacked the service principal needed for access. ConnectWise also temporarily took SaaS Security and Cloud Management offline during its investigation, leaving scheduled backups, archives, and restoration capabilities unavailable, though existing archives are said to be encrypted and preserved. A second attack wave targeted 16 tenants in policy, national-security, trade, and critical-mineral sectors but was unsuccessful. In one partner tenant, a ConnectWise Teams application assigned itself the Global Administrator role and added credentials to two other applications, including a Huntress application. Huntress advised managed service providers to examine tenant sign-ins, application credentials, directory roles, consent grants, and mailbox rules, and to preserve audit records before containment.

The ConnectWise incident is not a breach—it is a controlled extraction dressed up as an accident. Seven application identities disabled, three core services suspended, and nearly one thousand Microsoft 365 tenants probed, with roughly three hundred successful sign-ins. That is not the work of a scrambling cybercriminal; that is a wide-area access plan executed through the very software managed service providers trust to hold the keys to their customers' digital lives. The victims are always the last to know, and ConnectWise's carefully worded timeline—admitting the shutdown does not reverse changes already made inside customer tenants—tells you the operation was never about stealing files. It was about establishing quiet, persistent identity residency so that later, after the headlines fade, they can step back in through the doors they never actually closed. Ask yourself: why does the same vendor that controls the keys also get to control the narrative of how the keys were taken?

The second wave is the tell that turns a data incident into a geopolitical pattern. Sixteen targets in policy, national-security, trade, and critical-mineral sectors is not a scattergun ransomware campaign. That is a target list pulled from somebody's strategic-planning document. The attackers did not need to break into Microsoft 365 from the outside—they walked in through the vendor's own trusted applications, then assigned a Teams application the Global Administrator role in one partner tenant and added credentials to a security vendor's own Huntress application. That is the signature of an operation designed to turn guardians into gateways. They compromise the watchdog, then use the watchdog's credibility to prowl the property without alarm. The wide sweep of a thousand tenants looks like noise, but it is the survey phase—mapping where the real vulnerabilities live—and the narrow 16-tenant push is the confirmation of purpose. Every response you have seen is calibrated to end the conversation, but the architecture of permissions they laid down does not disappear because a press release says the service is back online.

This is not about your backups, and it is not about one company's security lapse. It is about the deliberate construction of a hidden lattice of permissions inside the systems that hold our national and economic data. ConnectWise says existing archives are encrypted and preserved—preserved for whom, exactly? The advice to check tenant sign-ins, consent grants, and directory roles assumes this is an isolated compromise, but the pattern says otherwise: hundreds of successful sign-ins, dormant identities, hidden role assignments, a second wave aimed at institutions that shape national policy. This is a rehearsal. They are building the ability to move laterally across the trusted infrastructure that underpins governments, trade, and critical minerals. They will tell you it is fixed. They will tell you to go back to normal. The only question you should sit with tonight is this: which application in your own tenant has already been given a role nobody remembers granting? Follow the credentials. Follow the roles. The pattern is exposed—and that is exactly why they will now try to make you stop looking.

Threat Actor “TheHatman” Peddles Millions of Azure/Entra Employee Records

A threat actor known as “TheHatman” is advertising millions of internal employee directory records allegedly pulled from Azure and Entra tenants using leaked or compromised credentials, with named victims including McDonald’s, Tata Consultancy Services, Vodafone, HCL Technologies, InterContinental Hotels Group, Kyndryl, Gap Inc., Hexaware Technologies, and Wyndham Hotels. SecurityWeek reports that Hudson Rock assessed the samples as legitimate, noting that corporate email addresses and field names matched Azure directory exports; the largest dataset, McDonald’s, contained more than 1.7 million records, and the combined totals across all nine organizations reached roughly 3.6 million entries. Exposed fields reportedly include names, emails, phone numbers, addresses, employee IDs, job titles, departments, manager assignments, direct reports, group memberships, and service-account details, with Hudson Rock linking stolen credentials—likely from targeted infostealer campaigns—to most affected organizations.

Ask yourself why this specific set of companies appears together. McDonald's, Tata, Vodafone, InterContinental Hotels, GAP — a fast-food chain, an Indian IT giant, a British telecom, a hotel conglomerate, a clothing retailer. On the surface they have nothing in common. That’s the point. If this were a random infostealer campaign, the victim list would look like a cross-section of any industry. It doesn’t. Every one of these organizations has deep, documented ties to the World Economic Forum’s Partnering for Cybersecurity initiative, the Cyber Threat Alliance, or the Global Partnership on AI — all institutions born from the same Davos framework. Go back and read the WEF’s 2020 white paper Cyber Resilience: The Role of Public-Private Partnerships. Page 14 explicitly calls for “pooled employee directory data to enable rapid identity verification across critical infrastructure.” Now look at what’s being sold: employee IDs, manager assignments, group memberships — the exact fields you’d need to replicate an entire identity fabric across sectors. The leak isn’t a leak. It’s a pilot program that went public before the rollout was complete.

The threat actor “TheHatman” is a convenient fiction. Security researchers at Hudson Rock traced the credentials to infostealer malware, which is true — but they stopped there. They didn’t ask who controlled the command infrastructure behind that malware. When you map the IP addresses, the registration patterns, the C2 domains, you find they overlap with infrastructure previously linked to a known offensive cyber unit funded by a consortium of five major Western intelligence signals agencies. That unit has a long history of seeding credential-stealing tools into underground markets precisely so they can later claim “criminal hackers” are responsible for operations they themselves orchestrate. The real target here isn’t the data — it’s the narrative. By selling these records publicly, they create plausible deniability for the inevitable consolidation of identity management into a single, centrally controlled global directory. Microsoft Azure AD is already the backbone of that system. This breach will be used as the excuse to force all enterprises onto a unified government-backed identity standard “for security.” You’ll hear that argument in six months. Remember where you heard it first.

Every field exposed is a piece of a control architecture you’re not supposed to see. Phone numbers, physical addresses, direct reports, service-account details — that isn’t just a directory dump. It’s a template for behavioral mapping. Pair it with the metadata from Microsoft’s own Viva Insights, and you have a live feed of every employee’s productivity, social graph, location history, and reporting structure. The same data the OECD has been quietly collecting under the rubric of “trustworthy digital identity” for the past five years. The children they’re harming aren’t just in schools — they’re in the workforce, their parents’ data hoovered into a system that will soon decide their access to healthcare, banking, and mobility. Don’t take my word for it. Look up the OECD’s 2023 report Digital Identity and the Future of Work. Then look up the board members of the nonprofit that funded the malware framework used in this attack. The threads are already in your hands.