ConnectWise Credential Compromise Enables Unauthorized Access to 173 Microsoft 365 Tenants: Cybersecurity Incident Analysis

Executive Summary

On October 13, 2026, unauthorized access was detected across 173 Microsoft 365 tenants via a compromised ConnectWise service account credential. The attackers exploited delegated admin privileges, enabling broad access to sensitive data including mailboxes, OneDrive, SharePoint, Teams, and directory information. The incident did not involve a software vulnerability in ConnectWise but rather the theft or exposure of a legitimate credential. Affected organizations span managed service providers (MSPs), law firms, national security and trade entities, and critical infrastructure sectors. The attack leveraged only legitimate credentials and native Microsoft 365 administration tools, making detection challenging. Immediate remediation steps included disabling the compromised credential and revoking admin privileges. No malware was identified, and no specific threat actor attribution has been made. All findings are based on evidence from The Hacker News (Oct 17,…