decrypted · 19 october 2026 · supply chain · uk policy and law · ai and llm security

ConnectWise's cloud breach widens, and MFA could not stop it

Yesterday we covered ConnectWise's backup app and the master key it held to Microsoft 365 tenants. The story has grown. ConnectWise has switched off two more services, and Huntress, a security firm, reports sign-ins from the attacker's address across nearly 1,000 Entra tenants (Entra is Microsoft's identity system), more than 300 of them successful. If your IT comes from a managed service provider (MSP), an outsourced IT firm, you now have checking to do.

What is new since yesterday

ConnectWise suspended Cloud Backup on 17 October. On 18 October it also took SaaS Security and Cloud Management offline as a precaution, with no restoration date. Huntress says the attacker also abused ConnectWise's Cloud Management apps for Exchange Online, Teams and SharePoint Online, and ConnectWise's latest update added two more attacker IP addresses to the indicators. In one tenant, a Cloud Management app gave itself the Global Administrator role and added new credentials within about five minutes. ConnectWise says archived backups remain encrypted and it has no evidence they were accessed. How the vendor's credential was obtained has not been disclosed.

Why multi-factor authentication did not help

Picture a maintenance firm that holds a master key for every customer's building. The thief does not pick any lock. They steal the firm's key ring.

Todyl, another security firm, found the attacker presented the backup app's own credential to Entra and received a token for each tenant. No user signed in, so MFA, the second check on top of a password, never applied, and Conditional Access, Microsoft's login rules, recorded "notApplied". Revoking user sessions does not end this kind of access. The app held read and write rights over mail, OneDrive and SharePoint files and Teams chats, across every mailbox rather than one. Microsoft Threat Intelligence called it an active supply-chain attack.

What the defender can and cannot see

Where a tenant had an active backup subscription, Todyl says it cannot tell the attacker's reads from the genuine service's, because both use the same identity and per-request addresses were not logged. Huntress adds that directory reads through Microsoft Graph leave no audit trail, so data access cannot be ruled out.

The Secure by Design lesson

The design decision was standing, tenant-wide permission: one vendor credential, in one place, able to act inside hundreds of customer environments, with nothing a customer could do to constrain it. Microsoft assessed the attacker likely abused permissions already granted, including Directory.ReadWrite.All.

What it costs to apply the lesson is an afternoon:

List every enterprise app in your tenant and disable, not delete, the ConnectWise and SkyKick ones. Deleting removes consent. Keep them off until ConnectWise confirms its credentials are reset.
Remove any directory role those apps hold that you did not grant, and check app secrets added since 13 October.
Ask your MSP, in writing, which of its tools hold permanent access to your tenant, and whether you can give time-limited access instead.

Also this week

Breach: one stolen login, millions of pupils. Educational Testing Service (ETS), which runs California's statewide assessments, says someone used a compromised credential on its secure file transfer site between 22 May and 18 September 2026. ETS spotted the activity on 25 September, disabled the account and took the site offline. The California Department of Education says all students enrolled in the previous three school years are affected, plus some who left as far back as 2006. The data includes names, birth dates, addresses and school details, and for some pupils disability and test accommodation records. How the login was compromised is unexplained. A supplier's login is your data's front door.

AI security: ATT&CK gets an AI chapter. MITRE's ATT&CK v20 splits prompt injection into direct and indirect techniques and adds one for attackers using an organisation's own AI agents to steal data. It also adds stealing application-specific passwords, which can sign someone in without an MFA prompt, and extends compromised dependencies to development tool and coding agent configuration files. The framework is how many security teams label what they detect, so ask yours which of these it can spot today.

Policy: the ICO wants your view on AI agents. The ICO says that the autonomy of AI agents "is not an excuse for poor compliance". Its call for evidence on data protection risks from agents closes on 20 November 2026, and it has contacted OpenAI, Anthropic, Meta and the AI Security Institute about recent agent testing incidents. It also reports that ten foundation model developers have made or committed to data protection changes. If you give agents access to personal data, this is the consultation to read.

Sources

If you want a second pair of eyes on which suppliers hold standing access to your systems, get in touch.