Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants

Coverage of the incident appears simultaneously across four specialist publications. Cyber Press highlighted that the compromised SkyKick credentials forced a shutdown of the affected backup services, while CyberSecurityNews quantified the scope by noting the 173 Microsoft 365 accounts breached. BleepingComputer framed the event as a supply‑chain attack, emphasizing the reliance of many organizations on ConnectWise’s third‑party tools.

The Hacker News echoed the core details, confirming that the same compromised ConnectWise credential was used to gain access to the 173 tenants. Microsoft 365 remains a primary productivity platform for enterprises worldwide, so any unauthorized entry can expose email, files, and collaboration tools. Supply‑chain attacks such as this exploit the trust placed in a vendor’s infrastructure, allowing malicious actors to move laterally into multiple downstream environments without needing to breach each tenant individually.

Future reporting is expected to focus on remediation steps announced by Microsoft and ConnectWise, including possible credential rotation, mandatory password resets, and guidance for affected tenants. Observers will watch for official statements regarding the extent of data exposure and any additional compromised credentials that may surface. Stakeholders are advised to monitor updates from the four outlets that broke the story and to prepare for potential security advisories from the vendors involved.