ConnectWise

In mid-October 2026, attackers signed in as ConnectWise's Cloud Backup application identities with a vendor credential of unstated origin, and in two Microsoft 365 tenants, Huntress observed that the app granted itself Global Administrator. Microsoft attributes the campaign to Storm-0940 and puts the targets above 2,250 tenants; how many fell, and what data left those tenants, nobody has said. A backup tool held enough privilege to crown itself keeper of the gate, so one vendor credential became every customer's perimeter.