What happened
ConnectWise says it discovered unauthorised access on October 14, 2026 and began internal and external incident response. At 07:00 UTC on October 17, 2026, ConnectWise disabled seven application identities and revoked their associated credentials. On October 28, 2026 at 16:00 UTC, ConnectWise began phased restoration of Microsoft 365 backup and restore functions through a new application. Partners must reset their Cloud Services password, complete multifactor authentication and re-authorise each Microsoft 365 tenant before backups and restores can resume.
ConnectWise’s new restoration application is named “ConnectWise Cloud Backup for M365.” Re-authorisation alone does not demonstrate that backup operation has resumed: ConnectWise directs partners to verify that new snapshots complete. The vendor says customer access, monitoring, reporting, export, billing and notifications will return in later phases. ConnectWise says existing backup archives remain encrypted, isolated and preserved, with no indication of compromise.
The seven affected application IDs are: ConnectWise Cloud Backup 506e08f9-6e9a-4da4-942b-a099a03644ae; ConnectWise Cloud Management 2399d300-6fca-4e6a-a686-399fefe75b83; Cloud Management - MS Teams 24205314-2b89-4e07-a2a4-579e898a5640; Cloud Management - Exchange Online b78f6a77-d4e5-46fb-87e5-d1648bd02519; Cloud Management - MS Graph 0de14c77-b9b0-4137-9360-34878a929827; Cloud Management - Partner Center 412dcf96-176d-4b3a-a1b0-4981ad66971e; and Cloud Management - SharePoint Online b2b55f5b-7758-4719-8d8f-88ae172e6bdb. The published suspicious IP addresses are 144.172.64[.]128, 144.172.64[.]99 and 144.172.64[.]60.
The investigation guide directs tenant review from October 13, 2026 through the current time, extending to October 1, 2026 where records are available. Microsoft Entra normally retains audit and sign-in records for seven days on Free licences and 30 days on P1/P2 licences; expired history is not recovered by upgrading. Administrators are instructed to preserve Entra, Purview, SIEM and Graph evidence, then examine application credentials, role assignments, consent grants, Conditional Access changes, forwarding, mailbox permissions and hidden inbox rules. Neither ConnectWise nor Microsoft has published a definitive count of downstream tenants with confirmed compromise or data exfiltration. The cited source did not publish the precise quantity described as Confirmed downstream compromise count.
Why this matters now
The October 28 restoration changes the decision from waiting for a vendor recovery plan to controlling thousands of individual trust re-establishment events. Each tenant must authorise a new application, but the old identities, historic tokens, attacker-added credentials, role grants, mailbox changes or application consent cannot be declared harmless merely because ConnectWise has replaced its vendor-side credentials.
This is simultaneously an identity incident and a resilience event. Partners have operated with interrupted backup, restore, monitoring and management functions, while the same application trust could have permitted access to live Microsoft 365 resources. Recovery teams therefore need two independent workstreams: restore protection safely and investigate compromise without destroying evidence. Treating the first successful sign-in or snapshot as closure would collapse those distinct obligations.
The model is particularly exposed where an MSP administers many tenants, historic SkyKick integrations remain installed, Entra retention is short, or no customer-level owner has been assigned. A single partner-level status report cannot establish the condition of each downstream environment. Boards and risk owners should require a tenant register showing evidence coverage, unresolved findings and the recovery point available during the protection gap.
The decision for security leaders
Authorise a two-gate recovery process. The security gate requires evidence preservation, application-identity review and disposition of unexplained changes. The resilience gate requires a successful new snapshot and an isolated restore. Neither gate substitutes for the other, and a tenant remains open until both have documented owners and results.
Make the tenant, not the vendor incident, the unit of closure. Require the MSP or internal platform team to list every customer environment where current or historic ConnectWise or SkyKick identities exist, including dormant connections. Record local Object IDs because display names can change and similarly named applications do not establish identity.
Do not delete enterprise applications as the first response. Preserve configuration, consent and audit evidence before irreversible changes. Where unauthorised credentials, roles, owners, grants or mailbox changes are found, transfer control to incident response and widen the investigation to every tenant reachable through the affected management identity.
Evidence of closure
- A tenant register records all seven application IDs, local Object IDs, owners, findings and evidence locations.
- Exported Entra and Purview records cover available history, with retention gaps documented.
- Validation finds no remaining unauthorised credentials, roles, consent grants, policies, forwarding or mailbox rules.
- A new snapshot completes and an isolated restore succeeds after authorised reconnection.
The Security.io assessment
The materially new fact is that partners can now reconnect through a replacement application. That improves continuity but increases execution risk: administrators under service pressure may treat re-authorisation as an ordinary migration and erase or overlook evidence of prior access. Security leadership should explicitly classify the work as incident recovery until tenant-level investigation and restore testing are complete.
The agentic framework named in the cited sources is ARTEX. The cited sources do not identify the underlying model or version used in the ConnectWise operation. Microsoft says Storm-0940 operated ARTEX, but the cited sources do not publish the operator’s prompts, target list or runtime configuration. Microsoft reports that ARTEX accelerated scanning and reconnaissance, password spraying and OAuth application abuse, with follow-on Microsoft Graph activity in multiple environments.
Attribution posture: Microsoft attributes the ConnectWise supply-chain compromise to Storm-0940, a China-state aligned actor; ConnectWise says the evidence available to it points to the same group. Attribution strengthens the case for broad cloud-control-plane review, but it does not establish compromise in every tenant or prove data access. The operational conclusion must remain evidence-based and tenant-specific.
Questions for the morning meeting
- Can every current and former ConnectWise or SkyKick tenant be assigned to a named investigator today?
- What business service depends on backups that have not produced a successful snapshot since the interruption?
- Who can approve re-authorisation only after evidence preservation, containment review and recovery validation are complete?