# ConnectWise disables seven application identities after Microsoft 365 compromise

_Published Sunday, October 18, 2026 at 6:06 AM EDT · Security · Latest · Tier 2 — Notable_

![ConnectWise disables seven application identities after Microsoft 365 compromise — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjxTJ5xsWsmrBmF1q18Gi5uaokNeC6-M0VbSf0T5X3KMQH7QGMhC7mz4XB6TUJuE7P9tjknMAqaGQ-Iz_7UuQ-NdKKXJTgqLhHMipRcd57VUOpwfJ2xxO8Hq_PX8hotdp_KZddNDzfQFw3bLHbYYLasThNbqGlidzhZ485ApBIKh2KUgn4g6PeBbhMwhc0T/s1700-nu-rw-lo-l85-e365/ms-connect.jpg)

ConnectWise said it disabled seven application identities on October 17 at 07:00 UTC after attackers obtained unauthorized access and compromised Microsoft 365 tenants. The action extends across Cloud Backup and Cloud Management connections, including Teams, Exchange Online and SharePoint Online.

The company also revoked certificates for affected Cloud Backup connections across all users. Scheduled backups have stopped, and affected archives and restoration capabilities remain unavailable. ConnectWise says existing archives remain encrypted, isolated and preserved, with no evidence attackers accessed them.

Disabling connections prevents new authentication but does not undo tenant changes. Previously issued tokens may remain usable, and credentials attackers planted in separate identities require additional remediation.

## Sources

- [The Hacker News](https://thehackernews.com/2026/10/connectwise-suspends-cloud-backup-after.html)

---
Canonical: https://techandbusiness.org/newswire/LJ0PyIewYAgxVNKbyzU73d
Published: 2026-10-18T10:06:09.840Z
Story chronology: 2026-10-17T07:00:00.000Z
Retrieved: 2026-10-18T12:42:09.198Z
Publisher: Tech & Business (techandbusiness.org)