Soft ComputersA supply-chain attack targeting ConnectWise has compromised at least 173 Microsoft 365 business tenants. Bleeping Computer and The Hacker News both reported on this over the weekend of October 17 to 19, 2026. ConnectWise subsequently suspended its cloud backup service while it investigates. This is not a minor incident buried in the tech news. It is a direct threat to any Canadian business whose managed IT provider uses ConnectWise tools.
What Actually Happened
ConnectWise is one of the most widely used platforms in the managed IT services industry. IT providers across Canada use it to remotely monitor and manage client systems, automate ticketing, and run backup workflows. In this attack, hackers obtained a compromised ConnectWise credential and used it to authenticate into 173 separate Microsoft 365 tenants. That means they walked in through the front door using a legitimate login, not by cracking encryption or exploiting a complex zero-day.
Once inside those tenants, attackers had access to email, SharePoint files, OneDrive documents, and any other data stored in Microsoft 365. ConnectWise responded by suspending its cloud backup product, which itself signals how serious the company considers the situation. According to Bleeping Computer's reporting, this is being treated as a supply-chain attack because the attackers did not breach each business individually. They breached one provider-level credential and used it to reach hundreds of businesses at once.
Why This Hits SMBs Particularly Hard
Large enterprises typically run their own internal IT teams and have direct relationships with Microsoft. Most Canadian small and mid-sized businesses do not. They hand over administrative access to a managed service provider (MSP) so that provider can maintain their systems efficiently. That arrangement is sensible and cost-effective, but it creates a shared risk model. When the MSP's tools or credentials are compromised, every client connected to those tools becomes a potential victim.
You may have done everything right: enabled MFA for your own staff, kept your own passwords strong, trained your team on phishing. None of that matters if the account your IT provider uses to manage your Microsoft 365 environment gets stolen upstream.
This is not a hypothetical. One credential. 173 tenants. Real business data exposed across all of them.
What You Should Do Right Now
- Ask your IT provider directly whether they use ConnectWise. If they do, ask them specifically whether their ConnectWise credentials were part of this incident and what steps they have taken since October 17, 2026.
- Request a Microsoft 365 sign-in audit. Your IT provider or Microsoft's own admin portal (Entra ID, formerly Azure Active Directory) can pull a log of every account that authenticated into your tenant over the past 30 days. Look for any sign-ins from unfamiliar IP addresses, locations, or service accounts you did not authorize.
- Check what delegated permissions your MSP holds. In Microsoft 365, external partners are often granted Global Administrator access to your tenant. That is the highest permission level available. Ask your provider to explain exactly what access they hold and whether any of those delegated permissions were touched during the incident window.
- Rotate credentials on any shared admin accounts. If your business has any shared Microsoft 365 admin accounts that your IT provider also uses, change those passwords immediately and confirm MFA is active on every one of them.
- Verify your own backups exist outside of ConnectWise. ConnectWise suspended its cloud backup service as part of its response. If your only Microsoft 365 backup ran through that service, you may have a gap right now. Confirm with your provider that a separate, working backup of your email and files exists today.
The Broader Lesson About MSP Trust
We work with MSP tools ourselves, and we understand why providers use platforms like ConnectWise. They make remote management faster and more consistent across many clients. But this incident is a reminder that the security of your business data is only as strong as the security posture of every vendor and tool in your provider's stack.
When you evaluate an IT provider, it is entirely reasonable to ask: what remote management tools do you use, how do you secure those accounts, and what happens to my data if your tooling is compromised? A provider that cannot answer those questions clearly is a risk to your business, even if their service desk is friendly and their response times are good.
We conduct regular internal audits of every third-party tool we use that touches client environments. If you are a current client and want to confirm your Microsoft 365 tenant shows no unusual access, contact our team this week and we will pull that report with you directly.
Source: Bleeping Computer.