Security
ConnectWise breach exposed thousands of customer environments
Microsoft says China-aligned hackers used stolen ConnectWise cloud-backup credentials to target about 2,250 organizations. AI agents running the open-source ARTEX framework generated nearly 3,000 login attempts per minute and reached Microsoft-hosted environments, where attackers could read email and files. ConnectWise suspended cloud-backup access and was investigating the incident on October 22, 2026.
Microsoft security researchers say China state-aligned hackers broke into ConnectWise’s cloud backup service and took application credentials used to connect the service with corporate customer systems. Those credentials allowed the attackers to enter Microsoft-hosted environments as authorized users and access email and other files.
Microsoft estimates that the attackers targeted about 2,250 organizations. Their tools generated almost 3,000 attempted sign-ins per minute, leaving defenders little time to detect the activity. Microsoft linked the speed to AI agents using ARTEX, an open-source framework for testing cyber defenses. The same software was involved in a recent compromise of South Korean financial systems, where many targets had weak security and no multi-factor authentication.
ConnectWise paused access to its cloud backup service and began investigating. On October 22, 2026, the company said it was working to restore the service.
Readers’ Forum
No contributions yet — open the debate.
Open the discussion
No account or password needed — just enter your e-mail and we’ll send you a one-time sign-in link. First time here? You’re set up automatically.
Your rating will be applied automatically after you sign in.
Check your inbox
We’ve sent a sign-in link to …. Open it on this device — this tab will sign you in automatically.
Nothing arrived? Check your spam folder — and mark the mail as "Not spam" so it lands in your inbox next time.