# ConnectWise breach exposed thousands of companies to spying

> Microsoft says China-linked hackers stole ConnectWise credentials and used AI agents to target about 2,250 organizations. ConnectWise paused its cloud backup service.

Oossa · 2026-10-22 · https://oossa.com/en/connectwise-breach-exposed-thousands-of-companies-to-spying

Event date: 2026-10-22

China state-aligned hackers broke into ConnectWise’s cloud backup service and stole credentials used to connect the service with customers’ systems, Microsoft security researchers say. Those credentials could let the attackers enter customers’ Microsoft-hosted environments as authorized users and reach email and other files.

Microsoft says the hackers used AI agents to make nearly 3,000 sign-in attempts per minute against around 2,250 organizations. That figure describes attempted sign-ins; the source does not say how many attempts succeeded or identify the organizations affected.

## How the breach worked

The stolen application credentials link ConnectWise’s backup service to corporate customer accounts. Once inside a customer’s Microsoft environment, attackers could access data there, rather than only the backups held by ConnectWise.

Microsoft attributed the speed of the campaign to ARTEX, an open-source AI framework designed to work with AI models to stress-test cyber defenses. The source says the same software was used in a recent compromise of South Korea’s financial systems, where many organizations reportedly had weak security and lacked multi-factor authentication. It does not provide technical details about how ARTEX was used in either incident.

## ConnectWise response

ConnectWise said it had paused access to its cloud backup system and was investigating the breach. On October 22, the company said it was working to restore the service. The source does not name affected customers, say how many accounts were successfully accessed, or specify what data the attackers obtained.

Microsoft’s account highlights how stolen credentials can turn a service-provider breach into a route toward customers’ own systems. But the reported pace of sign-in attempts does not, by itself, show that every targeted organization was breached.

## The facts

- Microsoft researchers attributed the campaign to China state-aligned hackers.
- Microsoft says attackers targeted around 2,250 organizations and made nearly 3,000 attempted sign-ins per minute.
- The attackers stole application credentials from ConnectWise’s cloud backup service, according to Microsoft.
- ConnectWise said it paused access to the service and was working to restore it on October 22, 2026.

## Why it matters

For companies that connect Microsoft-hosted accounts to ConnectWise’s backup service, stolen credentials could expose email and other files beyond the backup system. The source does not identify affected customers or confirm how many organizations had data accessed, so the actual reach remains unclear.

## Sources & references

1. [Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise](https://techcrunch.com/2026/10/22/chinese-hackers-spied-on-thousands-of-companies-after-breaching-it-giant-connectwise/) – TechCrunch, 2026-10-22

Last updated: 2026-10-22