Back Office BeatSubscribe

Published by J9 Systems. What's new in business tech, and what it means for yours.

From the brief of Friday, October 23, 2026 · No. 12

From the daily brief · AI

Microsoft: hackers used stolen ConnectWise backup keys to reach about 2,250 organizations

If your IT provider backs up your Microsoft email and files through ConnectWise, attackers tried to sign in through that app. Ask this week.

By Carter Josephson · · 2 min read

What happened

Microsoft says China-aligned attackers took over the identities of several ConnectWise cloud apps, including ConnectWise Cloud Backup, and used their credentials to sign in to customer Microsoft tenants. Sign-in attempts reached more than 2,250 tenants at up to 2,900 a minute, and Microsoft says most were unsuccessful and that a sign-in does not by itself mean data was taken.

What it means for a 10-to-50-person business

Most 10-to-50-person firms never buy ConnectWise themselves. Their managed IT provider does. If that provider backs up your Microsoft email and files through ConnectWise's cloud backup, the attackers may have been able to sign in through that app's credentials that does not depend on your staff's passwords or MFA prompts. Take a 20-person CPA firm in the middle of October extension season: 20 mailboxes full of client returns, Social Security numbers and bank details, backed up by its IT provider through ConnectWise. That firm needs three answers: is the ConnectWise backup app connected to our Microsoft account, has its access been removed or its credentials replaced, and do the sign-in and mailbox logs show anyone reading data who should not have. Microsoft also advises keeping the affected ConnectWise app connections disabled until ConnectWise issues restoration instructions, so backups may not be running; it needs a stopgap. Accounting firms, law practices and anyone holding client financial or medical data should care most. If you manage Microsoft 365 yourself with no third-party backup, or your provider confirms it does not use ConnectWise backup, you can stop here.

What to do
Ask your vendor

This week, email your IT provider and ask whether they use ConnectWise Cloud Backup on your Microsoft account, whether the app connection is disabled, and whether they have reviewed your Entra sign-in and audit logs back to Oct. 15.

What it costs
What it costs
IT provider check and credential cleanup, assume 3 hrs × $150/hr
≈ $450
Your time to brief staff and review the provider's answer
1 hr
Stopgap Microsoft 365 backup while ConnectWise's is paused, assume 20 users × $3/user/mo
≈ $60/mo
Doing nothing
$0 today; if the stolen app key still works, the attackers keep read access to email and files, and confirmed exposure of client data triggers state breach-notification duties (and, for tax preparers, FTC Safeguards Rule reporting)
Sources
microsoft.com (primary) · TechCrunch: Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise · ConnectWise trust center security advisories · CrowdStrike: Unknown threat actor uses ARTEX to target South Korean finance

Questions owners ask

We don't use ConnectWise. Are we in the clear?

You may not know. Many IT providers run ConnectWise tools behind the scenes. Ask your provider directly whether they use ConnectWise's cloud backup for your Microsoft account.

Will resetting everyone's passwords or turning on MFA fix this?

Not on its own. The stolen credentials belonged to an application, not a person. The fix is to remove or replace that app's access in your Microsoft account and review the logs. Password resets and MFA are still worth doing.

Should we cancel ConnectWise backup?

Not yet. Wait for ConnectWise's findings and your provider's answer. In the meantime, make sure some backup of your email and files is running while the service is paused.

Three to five of these, every weekday morning.

Related