# Compromised ConnectWise Credential Lets Attackers Reach 173 Microsoft 365 Tenants via Graph API

*Saturday, October 17, 2026 at 8:07 AM UTC — Hamer Intelligence Services Desk*

**Published**: 2026-10-17T08:07:56.365Z (2h ago)
**Category**: cyber | **Region**: Global
**Importance**: 7/10
**Sources**: OSINT
**Permalink**: https://hamerintel.com/data/articles/20799.md
**Source**: https://hamerintel.com/summaries

---

**Deck**: Attackers used a stolen ConnectWise Cloud Backup credential to access 173 Microsoft 365 customer and partner tenants through Microsoft Graph, potentially exposing emails, files and Teams data by abusing existing app permissions.

A stolen credential tied to a widely used IT management tool has given intruders a way into scores of Microsoft 365 environments, underscoring how dependent many organizations are on the security of their cloud suppliers.

According to a technical report, attackers obtained a compromised ConnectWise Cloud Backup credential and used it to access 173 Microsoft 365 customer and partner tenants. The credential allowed them to call Microsoft’s Graph API, which many applications use to read and write data across Outlook, OneDrive, SharePoint and Teams, while inheriting whatever permissions the linked app already had.

That meant the attackers did not have to break into each organization separately. By exploiting an existing trust relationship between ConnectWise Cloud Backup and Microsoft 365, they could potentially reach emails, files and Teams conversations wherever that application had been authorized. Public reporting so far has not detailed exactly what data was taken from which tenants, but the technical pathway was open.

Many of the affected tenants are described as partner environments, such as managed service providers and resellers that administer Microsoft 365 for other customers. Compromising a partner can therefore expose not only its internal information but also configuration data and access routes into its downstream clients, broadening the impact beyond the initial 173 tenants.

From the point of view of employees at those organizations, the attack would not necessarily be obvious. Activity over Microsoft Graph can look like normal backup or search traffic in logs. Without close monitoring of which apps are accessing what data, and when, malicious use can blend into routine operations.

The breach feeds into growing concerns about software‑as‑a‑service supply chains. Enterprises grant third‑party cloud tools broad permissions so they can function, and in doing so trust vendors to safeguard credentials and code. When a single set of credentials fails, as in this case, the consequences can spread quickly across sectors and borders.

For policymakers and large customers, the incident adds weight to calls for more transparency from SaaS providers about how they manage keys, rotate credentials and monitor access to high‑value interfaces like Microsoft Graph. It also raises practical questions inside organizations about whether third‑party apps are being given more access than they need.

Important developments to track include whether further compromised tenants are identified beyond the 173 already reported, what changes Microsoft and ConnectWise make to authentication and monitoring, and whether major customers tighten or segment app permissions within their Microsoft 365 deployments.